CVE-2026-50291

Katalog CVE

CVSS 5.5 · Medium EPSS 0,20%

Kerentanan Out-of-bounds Read pada openimageio. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. BmpInput::read_native_scanline then performs an invalid palette read while decoding an RLE-compressed scanline, causing a process crash and denial of service. This issue is fixed in versions 3.0.16.0 and 3.1.11.0.

Rincian

Terbit di NVD

17 September 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 8,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-q3c7-3225-66h7 exploit · advisory vendor
• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/91500ed58ce927b7e710c6bbc3b7f795bb0791b5 patch
• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/be984856e315e0a82cd866745b544c8c4cb8bd45 patch
• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/ee3370d004d5895554239b4302c59eedb721f086 patch
• https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5030 issue tracking · patch
• https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.16.0 release notes
• https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.11.0 release notes