AcademySoftwareFoundation OpenImageIO up to 3.0.18.0/3.1.13.0 TGAInput::decode_pixel out-of-bounds

Summaryinfo

A vulnerability classified as problematic has been found in AcademySoftwareFoundation OpenImageIO up to 3.0.18.0/3.1.13.0. The affected element is the function TGAInput::decode_pixel. This manipulation causes out-of-bounds. This vulnerability is registered as CVE-2026-43996. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in AcademySoftwareFoundation OpenImageIO up to 3.0.18.0/3.1.13.0. It has been declared as problematic. Affected by this vulnerability is the function TGAInput::decode_pixel. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. The summary by CVE is:

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, the bounds check in TGAInput::decode_pixel computes k + palbytespp as unsigned 32-bit arithmetic. When k = 0xFFFFFFFC and palbytespp = 4, the addition wraps to 0, which compares less than palette_alloc_size and passes the check. The subsequent palette access uses the unwrapped k (0xFFFFFFFC) as the index, reading ~4 GB past the start of the palette buffer — SEGV. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-43996 since 05/04/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 314944 (Linux Distros Unpatched Vulnerability : CVE-2026-43996), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.0.18.0 or 3.1.13.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (314944) and EUVD (EUVD-2026-30417). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenImageIO

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18.0
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.1.8
• 3.1.9
• 3.1.10
• 3.1.11
• 3.1.12
• 3.1.13.0

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/OpenImageIO/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion