CVE-2026-113681: OpenImageIO 0 to before 3.0.20.0, 3.1.0.0 to before 3.1.15.0, 3.2.0.0-dev to before 3.2.0.3-beta1

Affected technology

OpenImageIO · 0 to before 3.0.20.0, 3.1.0.0 to before 3.1.15.0, 3.2.0.0-dev to before 3.2.0.3-beta1
AcademySoftwareFoundation

Description’s affected range: before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application. Vendor/CNA’s CVSS 4.0 assessment (base score 6.8/10) rates confidentiality and integrity impact as none; availability impact as high.