CVE-2024-40630

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 2.5.13.1

Description The issue is related to a bug in the heif input functionality of OpenImageIO, specifically in the HeifInput::seek subimage() function. This bug can lead to an information disclosure issue, particularly for programs that directly use the ImageInput APIs.

Recommendations For versions prior to 2.5.13.1, upgrade to version 2.5.13.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the HeifInput::seek subimage() function until the upgrade is applied.