OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 14, 2026 · NIST NVD

   Detected

   OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in

2. Jun 17, 2026 · NIST NVD

   Updated

   OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in

Affected

• cpe openimageio/openimageioversion unspecified
• cpe openimageio/openimageio3.2.0.2

Sources

• CVE.orgVulnerability recordCVE-2026-43906

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-43906

  OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to

  nvd.nist.gov

References

• Exploit · github.com