CVE-2026-43908

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43908", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-04T16:11:33.086Z", "datePublished": "2026-05-14T19:01:21.931Z", "dateUpdated": "2026-05-15T14:14:06.187Z"}, "containers": {"cna": {"title": "OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858"}], "affected": [{"vendor": "AcademySoftwareFoundation", "product": "OpenImageIO", "versions": [{"version": "< 3.0.18.0", "status": "affected"}, {"version": ">= 3.1.4.0-beta, < 3.1.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T19:01:21.931Z"}, "descriptions": [{"lang": "en", "value": "OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0."}], "source": {"advisory": "GHSA-2jr5-q49v-3858", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-15T14:13:22.550087Z", "id": "CVE-2026-43908", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T14:14:06.187Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43908", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-15T14:13:22.550087Z"}}}], "references": [{"url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T14:13:41.779Z"}}], "cna": {"title": "OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder", "source": {"advisory": "GHSA-2jr5-q49v-3858", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "AcademySoftwareFoundation", "product": "OpenImageIO", "versions": [{"status": "affected", "version": "< 3.0.18.0"}, {"status": "affected", "version": ">= 3.1.4.0-beta, < 3.1.13.0"}]}], "references": [{"url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858", "name": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T19:01:21.931Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43908", "state": "PUBLISHED", "dateUpdated": "2026-05-15T14:14:06.187Z", "dateReserved": "2026-05-04T16:11:33.086Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-14T19:01:21.931Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "OpenImageIO", "vendor": "AcademySoftwareFoundation", "versions": [{"status": "affected", "version": "< 3.0.18.0"}, {"status": "affected", "version": ">= 3.1.4.0-beta, < 3.1.13.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*", "matchCriteriaId": "90B206C1-E7DB-4175-8077-C76D5C8533AF", "versionEndExcluding": "3.0.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*", "matchCriteriaId": "34BBB27F-256F-4D15-A394-158343CB8B4D", "versionEndExcluding": "3.1.13.0", "versionStartIncluding": "3.1.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openimageio:openimageio:3.2.0.0:dev:*:*:*:*:*:*", "matchCriteriaId": "F43FE0AC-4CFC-485D-8370-37336EB2CEA0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openimageio:openimageio:3.2.0.2:dev:*:*:*:*:*:*", "matchCriteriaId": "450296D8-74F5-4847-8433-FE3DFB16C58E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0."}, {"lang": "es", "value": "OpenImageIO es un conjunto de herramientas para leer, escribir y manipular archivos de imagen de cualquier formato de archivo de imagen relevante para VFX / animaci\u00f3n. Antes de 3.0.18.0 y 3.1.13.0, un desbordamiento de entero de 32 bits con signo en la expresi\u00f3n de \u00edndice del bucle de p\u00edxeles i * 3 dentro de ConvertCbYCrYToRGB() hace que la funci\u00f3n calcule un gran desplazamiento de puntero negativo en el b\u00fafer de salida, produciendo una escritura fuera de l\u00edmites que bloquea el proceso. Esta vulnerabilidad est\u00e1 corregida en 3.0.18.0 y 3.1.13.0."}], "id": "CVE-2026-43908", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43908", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-15T14:13:22.550087Z", "version": "2.0.3"}}]}, "published": "2026-05-14T20:17:06.920", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.0.18.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.1.4.0-beta,3.1.13.0)"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 84.0, "source": "matching"}]}, "original": {"product": "OpenImageIO", "source": "cna", "vendor": "AcademySoftwareFoundation"}, "product": "openimageio", "vendor": "academysoftwarefoundation"}], "created": "2026-05-14T20:30:04.125099+00:00", "updated": "2026-05-15T11:15:25.897428+00:00", "vendors": ["academysoftwarefoundation", "academysoftwarefoundation$PRODUCT$openimageio"]}