CVE-2026-43904

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.18.0 OpenImageIO versions prior to 3.1.13.0

Description An issue exists in the toolset used for reading, writing, and manipulating image files for VFX and animation. Specifically, the softimageinput.cpp file fails to clamp the run length to the remaining scanline width before writing pixels in both mixed RLE (Run-Length Encoding, a form of lossless data compression) and pure RLE paths. While the raw packet path uses std::min for clamping, the RLE paths bypass this check. A specially crafted .pic file can trigger a heap overflow of up to 65535 bytes.

Recommendations Update to version 3.0.18.0. Update to version 3.1.13.0.