CVE-2026-43996
Description
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, the bounds check in TGAInput::decode_pixel computes k + palbytespp as unsigned 32-bit arithmetic. When k = 0xFFFFFFFC and palbytespp = 4, the addition wraps to 0, which compares less than palette_alloc_size and passes the check. The subsequent palette access uses the unwrapped k (0xFFFFFFFC) as the index, reading ~4 GB past the start of the palette buffer — SEGV. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
How to fix
- openimageio openimageio3.0.18.0, 3.1.13.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openimageio openimageio | v < 3.0.18.0, 3.1.0.0 ≤ v < 3.1.13.0, 3.2.0.0, 3.2.0.2 | 3.0.18.0, 3.1.13.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.