{"id":"CVE-2026-113681","summary":"OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read","details":"OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.","modified":"2026-10-21T09:40:59.714522303Z","published":"2026-10-20T15:40:41.797Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113681.json"},"references":[{"type":"PACKAGE","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO"},{"type":"ARTICLE","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/blob/v3.0.19.0/src/cineon.imageio/libcineon/Codec.cpp#L79-L82"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5567"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5568"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113681.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113681"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openimageio-before-3.0.20.0-3.1-x-before-3.1.15.0-and-3.2-x-before-3.2.0.3-beta1-cineon-reader-heap-out-of-bounds-read"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/academysoftwarefoundation/openimageio","events":[{"introduced":"0"},{"fixed":"49696331774f2da1f136c4217e23c1e4d920a376"},{"fixed":"cbe57bc005678ca310835473568121719861734c"},{"introduced":"a0940a9f1e4a8ff20edc9d550a4dea4723d1aa58"},{"fixed":"45414c1aedcd3cc98244b4c5802ec53e91976f70"},{"fixed":"07e3c3e0373551c57e7d8e01353deaa4b3646613"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"3.0.20.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"introduced":"3.1.0.0"},{"fixed":"3.1.15.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"strategy":"StandardRange","range":[{"introduced":"3.2.0.0-dev"},{"fixed":"3.2.0.3-beta1"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"07e3c3e0373551c57e7d8e01353deaa4b3646613"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v3.0.19.1","v3.1.14.1","v3.1.14.0","v3.0.19.0","v3.0.18.1","v3.1.13.1","v3.2.0.2-dev","v3.1.13.0","v3.0.18.0","v3.1.12.0","v3.0.17.0","v3.1.11.0","v3.0.16.0","v3.2.0.0-dev","v3.1.10.0","v3.0.15.0","v3.0.14.0","v3.1.9.0","v3.0.13.0","v3.1.8.0","v3.0.12.0","v3.1.7.0","v3.0.11.0","v3.1.6.2","v3.1.6.1","v3.1.6.0-rc1","v3.1.5.0-beta2","v3.0.10.1","v3.0.10.0","v3.1.4.0-beta","v3.0.9.0","v3.0.8.1","v3.0.8.0","v3.0.7.0","v3.0.6.1","v3.0.6.0","v3.0.5.0","v3.0.4.0","v3.0.3.1","v3.0.3.0","v3.0.2.0","v3.0.1.0","v3.0.0.3","v3.0.0.2-RC1","v3.0.0.1-beta2","v3.0.0.0-beta1","v2.6.5.0-dev","v2.6.2.0-dev","v2.6.1.0-dev","v2.5.2.0-dev","v2.5.0.0-dev","v2.4.2.2-dev","v2.4.2.1-dev","v2.4.2.0-dev","v2.4.1.1-dev","v2.4.0.3-dev","v2.4.0.2-dev","v2.4.0.1-dev","v2.4.0.0-dev","v2.3.6.0-dev","v2.3.5.0-dev","Release-2.3.4.0-dev","Release-2.3.3.0-dev","Release-2.3.2.0-dev","Release-2.3.1.0-dev","Release-2.3.0.0-dev","Release-2.2.3.0-dev","Release-2.2.2.0-dev","Release-2.2.1.1-dev","Release-2.2.1.0-dev","Release-2.2.0.0-dev","Release-2.1.8.0-RC1","Release-2.1.7-beta","Release-2.1.5.0-dev","Release-2.1.4.0-dev","Release-2.1.3-dev","spi-spcomp2-release-49.1","spi-Arn3.7.42.0","Release-2.1.2-dev","Release-2.1.1-dev","Release-2.1.0-dev","spi-spcomp2-release-48.0","spi-Arn3.7.25.0","spi-spcomp2-release-47.0","spi-Arn3.7.23.3","Release-2.0.1-RC1","Release-2.0.0-beta1","spi-spcomp2-release-45.4","spi-spcomp2-release-45.3","spi-spcomp2-release-45.1","spi-spcomp2-release-45.0","Release-1.9.4dev","Release-1.9.3dev","Release-1.9.2dev","spiArn-3.6.86.0","spi-spcomp2-release-44.2","spiArn-3.6.94.0","spi-spcomp2-release-44.1","spi-spcomp2-release-44.0","spiArn-3.6.84.0","spiArn-3.6.74.0","spi-Arn3.6.72.1","Release-1.9.1dev","spi-Arn3.6.69.3","spi-spcomp2-release-43.0","spi-Arn3.6.64.6","Release-1.8.4dev","spi-spcomp2-release-42.0-rhel7","spi-Arn3.6.36.0","Release-1.8.3dev","Release-1.8.2dev","spi-Arn3.6.33.4","spi-Arn3.6.27.0","Release-1.8.1dev","spi-Arn3.6.21.3","spi-Arn3.6.18.0","Release-1.8.0dev","spi-spcomp2-release-41.0","Release-1.7.6RC1","spi-Arn3.6.7.1","Release-1.7.5beta","Release-1.7.4dev","Release-1.7.3dev","spi-Arn3.5.93.10","spi-Arn3.5.91.0","Release-1.7.2dev","spi-Arn3.5.90.0","spiArn3.5.82.0","Release-1.7.1dev","Release-1.7.0dev","spiArn3.5.75.0","spi-spcomp2-release-39.1","Release-1.6.6beta","spiArn3.5.68.0","spi-spcomp2-release-38.0","spiArn3.5.66.0","spi-Arn3.5.82.0","spi-Arn3.5.75.0","spi-Arn3.5.68.0","spi-Arn3.5.66.0","spi-Arn3.4.72.0","spi-Arn3.4.71.0","Release-1.6.4dev","spiArn3.5.50.0","spi-Arn3.5.50.0","Release-1.6.3dev","spiArn3.5.48.0","spi-Arn3.5.48.0","spiArn3.5.45.1","spiArn3.5.45.0","spi-Arn3.5.45.1","spi-Arn3.5.45.0","spi-Arn3.5.41.0","Release-1.6.2dev","spi-Arn3.5.37.0","spi-Arn3.5.35.0","Release-1.6.1dev","spi-Arn3.5.31.0","spi-Arn3.5.28.0","spi-Arn3.5.26.0","spi-Arn3.5.25.0","Release-1.5.7dev","spi-Arn3.5.24.0","Release-1.5.6dev","Release-1.5.5dev","spi-Arn3.5.16.0","spi-Arn3.5.14.0","Release-1.5.4dev-pre-SIMD","spi-Arn3.5.13.1","Release-1.5.3dev","spi-Arn3.5.12.0","Release-1.5.2dev","spi-Arn3.5.11.0","spi-Arn3.5.10.0","Release-1.5.1dev","spi-Arn3.5.8.0","Release-1.5.0dev","spi-Arn3.5.5.0","Release-1.4.6RC1","spi-Arn3.5.2.0","Release-1.4.5dev","spi-Arn3.5.0.0","spi-Arn3.4.73.7","Release-1.4.4dev","Release-1.4.3dev","spi-v8-Arn3.4.73.6","spi-Arn3.4.73.6","Release-1.4.2dev","spi-v7-Arn3.4.73.3","Release-1.4.1dev","Release-1.3.6-dev","Arnold-3.4.72.0","arnold-3.4.71.0","Release-1.3.5-dev","Release-1.3.5","Release-1.3.4-dev","Release-1.3.3-dev","Release-1.3.2-dev","Release-1.3.1-dev","Release-1.3.0-dev","Release-1.1.1","Release-1.1.0","Release-1.1.0-beta4","Release-1.1.0-beta3","Release-1.1.0-beta2","Release-1.1.0-beta1","Release-1.0.1","Release-1.0.0","Release-0.10.0","spi-SpComp2-v20","spi-SpComp2-v9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113681.json","vanir_signatures":[{"target":{"function":"ReadPacked","file":"src/dpx.imageio/libdpx/ReaderInternal.h"},"deprecated":false,"digest":{"function_hash":"99597871854014780197708863551975218799","length":1153},"id":"CVE-2026-113681-0bcb1bc0","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613"},{"source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613","target":{"file":"src/dpx.imageio/dpxinput.cpp","function":"DPXInput::seek_subimage"},"deprecated":false,"digest":{"function_hash":"217194631032316723526521456751361170508","length":11560},"id":"CVE-2026-113681-10be3fe9","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"159383907641676986235514974437055877378","length":1055},"id":"CVE-2026-113681-179a5cbe","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613","target":{"file":"src/cineon.imageio/libcineon/ReaderInternal.h","function":"ReadPacked"},"deprecated":false},{"id":"CVE-2026-113681-2d611100","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613","target":{"function":"UnPackPacked","file":"src/cineon.imageio/libcineon/ReaderInternal.h"},"deprecated":false,"digest":{"length":649,"function_hash":"226842921167208664961297278495708168590"}},{"target":{"file":"src/dpx.imageio/libdpx/ReaderInternal.h","function":"Read10bitFilled"},"deprecated":false,"digest":{"length":1505,"function_hash":"63261060584689045517533902988162069859"},"id":"CVE-2026-113681-46fc892f","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613"},{"id":"CVE-2026-113681-4768afaa","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613","target":{"function":"CineonInput::open","file":"src/cineon.imageio/cineoninput.cpp"},"deprecated":false,"digest":{"length":8157,"function_hash":"205248434568906500864405272665692934272"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613","target":{"file":"src/cineon.imageio/cineoninput.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["73009772443616113813824781961176209634","277539097713233560446754560471704682153","141651815738782513075237132764367277316"]},"id":"CVE-2026-113681-62f691b1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613","target":{"file":"src/cineon.imageio/libcineon/ReaderInternal.h"},"deprecated":false,"digest":{"line_hashes":["250990733816713015213494668188756524048","80290667998058803732169410784066712004","316842338331577171803406516095652994978","96384737335040424670306658035127419859","336607821164711997278220707332492778882","50325439336038162818757000483984340496","116218482510577298406629073607625660402","285684354449724412990799801461403863671","306999254617417059952900527548992843455","100920958407931439199910240548523649242","215811328259551984398811176244327804239","264508968043254272894495249348002578320","168770745793280118114987573973428362039","120900527822192019949524577236743255757","77175170625917834092894231079386451896","322499660555312168918994814574671200889","53023120591064215667972663075068954460","214426258158080898801565717699436841019","63267190098207372674557697890644782191","57019373775289048281615783933530528302","16832237364580389971787270062839899624","95262800908107383381761655574659369366","34225370326802070823406487232108059063","251748489113791666062058328398855776300"],"threshold":0.9},"id":"CVE-2026-113681-80c26bab"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613","target":{"file":"src/dpx.imageio/libdpx/ReaderInternal.h"},"deprecated":false,"digest":{"line_hashes":["316053618047513812111720718114952003476","95253360493917550267669100146405739275","173213689123713846148559884666508154068","235598000382156208242642855327486448278","108804799885373215685016421485947643550","174803238094656551207960706256247780662","166694446489541661533990362491838766363","220661395003470326388209803467436550838","292839799698658838385913302114008101245","80290667998058803732169410784066712004","316842338331577171803406516095652994978","96384737335040424670306658035127419859","336607821164711997278220707332492778882","96378096731945847403578058392753562655","218377355790456407004556387065756947691","276078703915950418208790684306138196613","123588432073333696354273939241405109420","310823779286481088388663508838219002354","324727514956779686917737104469313301077","176875070942773774302110623965210524590","339923348119929252606059010380486064323","316121103846578711125979695512372911534","6390950603912552573064989321723808687","63267190098207372674557697890644782191","305007635789490611507390443851610724117","169849389671287573871835040763470835432","195322715879942617857121662942817263520","199638569118620797067586679637033735951","116358289431917708881340325609532595675","251748489113791666062058328398855776300"],"threshold":0.9},"id":"CVE-2026-113681-be01acab"},{"digest":{"length":668,"function_hash":"300094481514907975833309960809145654293"},"id":"CVE-2026-113681-c114a9f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613","target":{"function":"UnPackPacked","file":"src/dpx.imageio/libdpx/ReaderInternal.h"},"deprecated":false},{"target":{"file":"src/dpx.imageio/libdpx/Reader.cpp","function":"dpx::Reader::ReadBlock"},"deprecated":false,"digest":{"function_hash":"213666335677191533011247524095785567860","length":1550},"id":"CVE-2026-113681-d240c6b9","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613"},{"id":"CVE-2026-113681-eaa44bdb","signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613","target":{"file":"src/dpx.imageio/libdpx/Reader.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["150922089608317239138671249209358902976","334436843453256404521439355329356666080","36137753709117728208276635234265036034","143951352520903357313389421332242723938","123692376541450469884590597213555634402","286132657086012133087321331212959784822"]}}],"vanir_signatures_modified":"2026-10-21T09:40:59Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}