AcademySoftwareFoundation OpenImageIO prior 3.0.20.0/3.1.15.0/3.2.0.3-beta1 Iff Image iff.imageio/iffinput.cpp IffInput::readimg buffer overflow

Summaryinfo

A vulnerability has been found in AcademySoftwareFoundation OpenImageIO and classified as problematic. The impacted element is the function IffInput::readimg of the file iff.imageio/iffinput.cpp of the component Iff Image Handler. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2026-59956. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in AcademySoftwareFoundation OpenImageIO. Affected by this vulnerability is the function IffInput::readimg of the file iff.imageio/iffinput.cpp of the component Iff Image Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, An uncompressed 16-bit iff image with a z-buffer makes iffinput::readimg() allocate a temporary scanline from m_header.rgba_count but copy from it using m_header.pixel_bytes(), whose stride also includes z-buffer bytes. the oversized memcpy reads beyond the temporary heap buffer and copies adjacent memory into the output image, resulting in a crash or disclosure of adjacent heap data. The affected implementation is identified by src/iff.imageio/iffinput.cpp, IffInput::readimg(), m_header.rgba_count, and m_header.pixel_bytes(), which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-59956 since 07/07/2026. The exploitation appears to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 3.0.20.0, 3.1.15.0 or 3.2.0.3-beta1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenImageIO

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/OpenImageIO/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion