CVE-2026-113681 in OpenImageIO
Summary
by MITRE • 10/20/2026
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in OpenImageIO versions prior to 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 represents a critical memory safety issue rooted in improper integer arithmetic during the processing of Cineon image files. This flaw is specifically located within the cineon::Codec::Read function, which handles the decoding logic for this specific file format. The core technical deficiency involves an integer overflow that occurs when calculating the size required for the scanline buffer. When a malicious actor supplies a crafted Cineon file containing an excessively large declared width value, the arithmetic operation used to determine the necessary memory allocation fails to account for potential wraparound conditions. Consequently, the calculated size wraps around to zero or a significantly smaller positive integer than intended by the application logic.
This miscalculation leads directly to a heap-based buffer overflow scenario classified under CWE-190: Integer Overflow or Wraparound and CWE-787: Out-of-bounds Write. Although the initial calculation undersizes the allocated buffer, the subsequent operation UnPackPacked proceeds with expectations based on the original large width value rather than the truncated allocation size. As a result, the application attempts to read data past the boundaries of the four-byte buffer that was actually allocated due to the overflow error. This action constitutes an out-of-bounds memory access, specifically categorized as CWE-125: Out-of-bounds Read in many contexts where reading beyond bounds is the primary symptom, though it often leads to write vulnerabilities depending on implementation details. The immediate operational impact of this flaw is a denial of service condition manifested by application crashes or segmentation faults when processing the malformed input file.
From an attacker perspective, while the description highlights a crash, out-of-bounds reads can sometimes be leveraged for information disclosure if the memory contents are subsequently used in further operations without proper validation. However, in this specific instance involving UnPackPacked and buffer undersizing leading to crashes, the primary vector is denial of service. This aligns with ATT&CK technique T1499: Endpoint Denial of Service, where an adversary aims to disrupt availability by exhausting system resources or causing application instability through malformed inputs. The vulnerability underscores the risks associated with parsing complex binary formats without rigorous bounds checking and integer overflow protection mechanisms during memory allocation phases.
To mitigate this risk, organizations utilizing OpenImageIO must upgrade immediately to version 3.0.20.0 or later for the 3.0 branch, version 3.1.15.0 or later for the 3.1 branch, and version 3.2.0.3-beta1 or later for the 3.2 development stream. These releases contain patches that implement proper validation of input dimensions before performing arithmetic operations related to buffer sizing. Additionally, developers should enforce strict input sanitization on all external image data sources, ensuring that declared widths and heights are within expected operational limits prior to memory allocation. Implementing static analysis tools capable of detecting integer overflow patterns during the software development lifecycle can further prevent similar vulnerabilities from being introduced into future codebases.