{"id":"CVE-2026-113681","kind":"vulnerability","aliases":["CVE-2026-113681"],"related":[],"title":"OpenImageIO: crafted Cineon file causes heap out-of-bounds read and crash","description":"OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.","summary":"OpenImageIO's Cineon reader computes a scanline buffer size with an integer overflow when the declared width is huge, so the buffer is undersized. Opening a crafted Cineon file makes the application read past the buffer and crash.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","image-processing","openimageio","package"],"not_affected_if":["cineon-not-used","no-untrusted-cineon-input"],"how_to_check":"- Check the installed OpenImageIO version with `oiiotool --version` or the library version your application links against, and compare it to the fixed releases.\n- Search your application for file-loading paths that accept Cineon (.cin) files from untrusted sources.","fix":"- Upgrade OpenImageIO to `3.0.20.0` or later on the 3.0 line, `3.1.15.0` or later on the 3.1 line, or `3.2.0.3-beta1` or later on the 3.2 line.\n- Until upgraded, reject or sandbox .cin files from untrusted sources.","status":"open","published_at":"2026-10-20T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:44:40+00:00","updated_at":"2026-10-25T03:44:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:44:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenImageIO to `3.0.20.0` or later on the 3.0 line, `3.1.15.0` or later on the 3.1 line, or `3.2.0.3-beta1` or later on the 3.2 line.\n- Until upgraded, reject or sandbox .cin files from untrusted sources.","reach":"unknown","title":"OpenImageIO: crafted Cineon file causes heap out-of-bounds read and crash","impact":"low","summary":"OpenImageIO's Cineon reader computes a scanline buffer size with an integer overflow when the declared width is huge, so the buffer is undersized. Opening a crafted Cineon file makes the application read past the buffer and crash.","category":"package","nicknames":[],"who_cares":["openimageio","image-processing","c++"],"confidence":0.6,"needs_auth":"no","worst_case":"Application crashes while reading a crafted Cineon file","analyst_note":"","how_to_check":"- Check the installed OpenImageIO version with `oiiotool --version` or the library version your application links against, and compare it to the fixed releases.\n- Search your application for file-loading paths that accept Cineon (.cin) files from untrusted sources.","needs_analyst":false,"not_affected_if":["no-untrusted-cineon-input","cineon-not-used"],"who_is_affected":"Applications that use OpenImageIO to read Cineon images and accept those files from users or external systems are exposed to a crash. Systems that only process trusted internal files, or that do not load Cineon at all, can skip it. The sources describe a crash, not code execution.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000633,"input_tokens":3407,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113681':16A,19A '-2026':15A,18A '3.0.20.0':66C '3.1':67C '3.1.15.0':70C '3.2':72C '3.2.0.3':75C '4':122C 'applic':57B,128C 'attack':98C 'beta1':76C 'bound':10A,96C 'buffer':33B,47B,61B,89C,124C 'byte':123C 'c':20B 'calcul':114C 'caus':5A,90C 'cineon':3A,28B,53B,82C,103C 'codec':83C 'comput':30B 'contain':77C 'craft':2A,52B,102C 'crash':13A,63B,126C 'cve':14A,17A 'declar':41B,108C 'file':4A,54B,104C 'heap':6A,92C 'huge':44B,107C 'imag':22B 'image-process':21B 'integ':37B,79C 'make':55B 'open':50B 'openimageio':1A,24B,26B,64C 'out-of-bound':7A,93C 'overflow':38B,80C 'packag':25B 'past':59B,120C 'process':23B 'read':11A,58B,84C,97C,119C 'reader':29B 'scanlin':32B,88C 'size':34B,113C 'suppli':100C 'unders':49B,86C 'unpackpack':118C 'width':42B,109C 'wrap':111C 'x':68C,73C 'zero':116C","nicknames":[],"mitigations":[],"who_affected":"Applications that use OpenImageIO to read Cineon images and accept those files from users or external systems are exposed to a crash. Systems that only process trusted internal files, or that do not load Cineon at all, can skip it. The sources describe a crash, not code execution.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113681","severity":null,"published_at":"2026-10-20T16:17:13+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}