Live › vulnerability › CVE-2026-113681
Go to dashboardOpenImageIO's Cineon reader computes a scanline buffer size with an integer overflow when the declared width is huge, so the buffer is undersized. Opening a crafted Cineon file makes the application read past the buffer and crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use OpenImageIO to read Cineon images and accept those files from users or external systems are exposed to a crash. Systems that only process trusted internal files, or that do not load Cineon at all, can skip it. The sources describe a crash, not code execution.
No product ranges from the sources yet.
oiiotool --version or the library version your application links against, and compare it to the fixed releases.3.0.20.0 or later on the 3.0 line, 3.1.15.0 or later on the 3.1 line, or 3.2.0.3-beta1 or later on the 3.2 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.
This page as .md · .json · in your agent: get_signal("CVE-2026-113681")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.