CVE-2026-50291

MEDIUM 5.5

OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399)

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. BmpInput::read_native_scanline then performs an invalid palette read while decoding an RLE-compressed scanline, causing a process crash and denial of service. This issue is fixed in versions 3.0.16.0 and 3.1.11.0.

CWE	CWE-125
Vendor	academysoftwarefoundation
Product	openimageio
Published	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for academysoftwarefoundation openimageio

Be the first to know when new medium vulnerabilities affecting academysoftwarefoundation openimageio are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

AcademySoftwareFoundation / OpenImageIO

< 3.0.16.0 >= 3.1.0.0, < 3.1.11.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-q3c7-3225-66h7 github.com: https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5030 github.com: https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/91500ed58ce927b7e710c6bbc3b7f795bb0791b5 github.com: https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/be984856e315e0a82cd866745b544c8c4cb8bd45 github.com: https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/ee3370d004d5895554239b4302c59eedb721f086 github.com: https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.16.0 github.com: https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.11.0