CVE-2026-43903

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.18.0 OpenImageIO versions prior to 3.1.13.0

Description OpenImageIO is a toolset for reading, writing, and manipulating image files for VFX and animation. A heap buffer overflow and crash can occur when processing a crafted .sgi file where the RLE (Run-Length Encoding) count exceeds the scanline width. This happens because the sgiinput.cpp file uses OIIO DASSERT for bounds checking in the RLE decode loop; in release builds, this macro is compiled as a no-op, effectively disabling the bounds checks.

Recommendations Update to version 3.0.18.0. Update to version 3.1.13.0.