# AcademySoftwareFoundation OpenImageIO.

Every CVE that names AcademySoftwareFoundation OpenImageIO among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read](https://agentprime.io/advisories/CVE-2026-113681.md)
  `CVE-2026-113681` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 6.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [OpenImageIO: TGA-to-GIF palette split signed overflow causes SIGSEGV](https://agentprime.io/advisories/CVE-2026-65969.md)
  `CVE-2026-65969` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 5.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write](https://agentprime.io/advisories/CVE-2026-67549.md)
  `CVE-2026-67549` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 7.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [OpenImageIO: Cineon invalid bit depth heap out-of-bounds write](https://agentprime.io/advisories/CVE-2026-63638.md)
  `CVE-2026-63638` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 8.3 High · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [OpenImageIO: IFF ZBUFFER tile read writes past caller tile buffer](https://agentprime.io/advisories/CVE-2026-63419.md)
  `CVE-2026-63419` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 7.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [OpenImageIO: TIFF multithreaded scanline read use-after-scope in \`TIFFInput::read_native_scanlines\`](https://agentprime.io/advisories/CVE-2026-65970.md)
  `CVE-2026-65970` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS](https://agentprime.io/advisories/CVE-2026-63635.md)
  `CVE-2026-63635` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 5.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption, CWE-129
- [OpenImageIO OpenEXR plugin partial edge tile heap out-of-bounds write](https://agentprime.io/advisories/CVE-2026-63422.md)
  `CVE-2026-63422` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 7.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [OpenImageIO: PSD RawColor indexed image out-of-bounds read in \`interleave_row\`](https://agentprime.io/advisories/CVE-2026-63420.md)
  `CVE-2026-63420` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 5.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption, CWE-129
- [OpenImageIO: Stack buffer overflow in OpenImageIO Cineon reader via unchecked numberOfElements](https://agentprime.io/advisories/CVE-2026-59181.md)
  `CVE-2026-59181` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [OpenImageIO: Unbounded recursion in FITS header parser leads to stack overflow](https://agentprime.io/advisories/CVE-2026-59156.md)
  `CVE-2026-59156` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service
- [OpenImageIO: Heap-buffer-overread in IffInput::readimg() when ZBUFFER flag is set](https://agentprime.io/advisories/CVE-2026-59956.md)
  `CVE-2026-59956` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399)](https://agentprime.io/advisories/CVE-2026-50291.md)
  `CVE-2026-50291` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 5.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption
- [OpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSERT bounds checks are no-ops in release builds](https://agentprime.io/advisories/CVE-2026-43903.md)
  `CVE-2026-43903` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 8.4 High · Not analysed yet · Published 14 May 2026 · Tags: Memory corruption
- [OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width](https://agentprime.io/advisories/CVE-2026-43904.md)
  `CVE-2026-43904` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 8.4 High · Not analysed yet · Published 14 May 2026 · Tags: Memory corruption
- [OpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation](https://agentprime.io/advisories/CVE-2026-43905.md)
  `CVE-2026-43905` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 7.1 High · Not analysed yet · Published 14 May 2026 · Tags: Memory corruption
- [OpenImageIO: Integer wraparound in bounds check of decode_pixel leads to out-of-bounds read in TGA paletted image decoder](https://agentprime.io/advisories/CVE-2026-43996.md)
  `CVE-2026-43996` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 5.5 Medium · Not analysed yet · Published 14 May 2026 · Tags: Memory corruption
- [OpenImageIO: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR)](https://agentprime.io/advisories/CVE-2026-43907.md)
  `CVE-2026-43907` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 8.3 High · Not analysed yet · Published 14 May 2026 · Tags: Memory corruption
- [OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder](https://agentprime.io/advisories/CVE-2026-43908.md)
  `CVE-2026-43908` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 8.8 High · Not analysed yet · Published 14 May 2026 · Tags: Memory corruption
- [OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder](https://agentprime.io/advisories/CVE-2026-43909.md)
  `CVE-2026-43909` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 8.8 High · Not analysed yet · Published 14 May 2026 · Tags: Memory corruption
- [OpenImageIO: HEIF Heap overflow](https://agentprime.io/advisories/CVE-2026-43906.md)
  `CVE-2026-43906` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 8.5 High · Not analysed yet · Published 14 May 2026 · Tags: Memory corruption
- [AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write](https://agentprime.io/advisories/CVE-2026-7582.md)
  `CVE-2026-7582` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 4.8 Medium · Not analysed yet · Published 1 May 2026 · Tags: Memory corruption
- [HEIF Heap OOB Read in OpenImageIO](https://agentprime.io/advisories/CVE-2024-40630.md)
  `CVE-2024-40630` · CVE record: AcademySoftwareFoundation OpenImageIO · CVSS 4.3 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: Memory corruption

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=academysoftwarefoundation-openimageio>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/academysoftwarefoundation-openimageio/>. Everything for agents: <https://agentprime.io/llms.txt>.