CVE-2026-59181

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.20.0 OpenImageIO versions prior to 3.1.15.0 OpenImageIO versions prior to 3.2.0.3-beta1

Description A crafted Cineon file can provide a numberOfElements value exceeding the format maximum of eight. The CineonInput::open() function uses this unchecked value as a loop bound when filling the strings[8] array, causing pointers to be written beyond the stack buffer and into adjacent state. This leads to memory corruption and denial of service.

Recommendations Update to version 3.0.20.0. Update to version 3.1.15.0. Update to version 3.2.0.3-beta1.