CVE-2026-59156: OpenImageIO: Unbounded recursion in FITS header parser leads to stack overflow
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits stream containing consecutive 2880-byte header blocks without the mandatory end keyword makes fitsinput::readfitsheader() call itself without a depth bound. repeated recursive parsing exhausts the application stack, resulting in denial of service. The affected implementation is identified by src/fits.imageio/fitsinput.cpp, FitsInput::readfitsheader(), END keyword, and 2880-byte FITS header blocks, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.0.20.0 - Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.1.15.0 - Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.2.0.3-beta1
Event History
Frequently Asked Questions
What does an attacker need to trigger the denial of service?
An attacker needs to cause the application to parse a crafted FITS stream. The stream contains consecutive 2880-byte FITS header blocks without the mandatory END keyword, causing unbounded recursive header parsing until the application stack is exhausted.
Which deployments are affected?
OpenImageIO versions prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1 are affected. Exposure depends on whether an application using an affected version processes attacker-controlled or otherwise untrusted FITS input.
How can I determine whether a component is vulnerable?
Check the OpenImageIO version in use and whether its FITS parser includes FitsInput::read_fits_header() in src/fits.imageio/fitsinput.cpp. Versions earlier than the listed fixed releases are affected.
What should be done if an update cannot be applied immediately?
Avoid processing untrusted FITS streams, particularly files that can contain repeated 2880-byte header blocks without an END keyword. This reduces the opportunity for an attacker to trigger stack exhaustion.