CVE-2026-43905

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.18.0 OpenImageIO versions prior to 3.1.13.0

Description OpenImageIO is a toolset for reading, writing, and manipulating image files for VFX and animation. An issue exists in jpeg2000input.cpp where the buffer size is computed using signed 32-bit arithmetic via the calculation const int bufsize = w * h * ch * buffer bpp. If the resulting product exceeds INT MAX, the value wraps to zero or a small number, causing m buf.resize() to allocate an undersized buffer. This leads to a heap overflow during subsequent pixel write loops. This issue is conditional on the USE OPENJPH build flag.

Recommendations Update to version 3.0.18.0. Update to version 3.1.13.0.