CVE-2026-50291: OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399)
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. BmpInput::readnativescanline then performs an invalid palette read while decoding an RLE-compressed scanline, causing a process crash and denial of service. This issue is fixed in versions 3.0.16.0 and 3.1.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.0.16.0 - Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.1.11.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that process attacker-controlled BMP files using oiiotool or an application linked to OpenImageIO are exposed. The affected parsing path is reached when decoding an RLE-compressed BMP scanline with an empty color table.
What does an attacker need to trigger the crash?
An attacker needs a crafted BMP file to be processed by the vulnerable OpenImageIO code. The supplied data indicates user interaction is required, consistent with a user or application choosing to process the file.
Is the impact limited to denial of service?
Based on the provided information, the issue causes a process crash through an invalid palette read. The listed vector reports no confidentiality or integrity impact and high availability impact.
What versions contain the fix?
Upgrade to OpenImageIO 3.0.16.0 or 3.1.11.0, or a later version in the applicable release line.