CVE-2026-50291 in OpenImageIO
Summary
by MITRE • 09/18/2026
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. BmpInput::read_native_scanline then performs an invalid palette read while decoding an RLE-compressed scanline, causing a process crash and denial of service. This issue is fixed in versions 3.0.16.0 and 3.1.11.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
OpenImageIO serves as a critical infrastructure component within the visual effects and animation industries, providing robust tools for reading, writing, and manipulating image files across numerous formats. The software is widely integrated into production pipelines where it processes large volumes of imagery data. A significant vulnerability was identified in versions prior to 3.0.16.0 and 3.1.11.0 concerning the handling of Bitmap file structures. Specifically, the flaw resides within the BMP image input module located at src/bmp.imageio/bmpinput.cpp. This component is responsible for parsing various bitmap formats, including those utilizing run-length encoding compression schemes common in legacy or specific graphic design workflows.
The technical root cause of this vulnerability involves an improper validation check when processing a crafted BMP file that contains an empty color table while also employing RLE-compressed scanlines. During the decoding process, the function BmpInput::read_native_scanline attempts to access palette entries based on indices derived from the compressed data stream. Because the color table is empty, there are no valid entries to map these indices against. Instead of detecting this invalid state and terminating safely, the application proceeds with an out-of-bounds or null pointer dereference operation inherent in reading from a non-existent palette structure. This logic error leads directly to memory corruption or access violation conditions that destabilize the process execution environment.
The operational impact of this flaw is primarily characterized by a denial of service condition. When an attacker supplies a maliciously constructed BMP file with these specific characteristics, the processing application linked against OpenImageIO will crash unexpectedly upon attempting to decode the affected scanline. This disruption can halt automated rendering pipelines, cause data loss if unsaved work is involved, and create instability in any system relying on continuous image processing services. While the primary impact observed is a process termination rather than arbitrary code execution, such crashes can be leveraged for resource exhaustion attacks or as part of more complex exploitation chains targeting downstream applications that depend on stable input parsing from OpenImageIO libraries.
This vulnerability aligns with CWE-125, which describes Out-of-bounds Read, and potentially CWE-369, Divide By Zero if the empty table leads to division operations during index calculation, though the crash is most directly associated with invalid memory access patterns typical of improper input validation in image parsing libraries. In terms of threat modeling, this behavior corresponds to ATT&CK technique T1499, Endpoint Denial of Service, as it involves exploiting a software flaw to disrupt service availability rather than gaining unauthorized access or control over the system. The attack vector is local if processing untrusted files directly on a workstation, but can be remote if integrated into web-based image conversion services that accept user-uploaded BMPs without proper sanitization.
Mitigation strategies focus heavily on version management and input validation enhancements. Users must upgrade to OpenImageIO versions 3.0.16.0 or 3.1.11.0, where the developers have implemented fixes to properly validate palette data before attempting RLE decoding operations. For organizations unable to immediately patch their environments, implementing strict file type filtering and sandboxing for image processing tasks can reduce exposure. Additionally, integrating fuzz testing into continuous integration pipelines helps identify similar edge cases in other format parsers within the library suite. Security teams should also monitor for updates from OpenImageIO maintainers as new CVEs may emerge related to adjacent parsing logic flaws that share similar architectural patterns.