CVE-2026-43909 - Vulnerability Analysis

Overview

OpenImageIO < 3.0.18.0 and < 3.1.13.0 contain an integer overflow caused by a signed 32-bit overflow in the loop index in SwapRGBABytes() when processing large kABGR DPX images, letting attackers cause out-of-bounds read and write, exploit requires processing crafted large images.

Severity & Score

Impact

Attackers can cause out-of-bounds read and write, potentially leading to crashes or arbitrary code execution.

Mitigation

Update to version 3.0.18.0 or 3.1.13.0 or later.

References

• https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-g267-j53j-5258

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner