PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113681 AcademySoftwareFoundation CVE debrief

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains a heap out-of-bounds read vulnerability in the Cineon Reader. This vulnerability is caused by an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application. Defenders should prioritize verifying OpenImageIO versions and applying patches, focusing on systems handling Cineon files.

Vendor
AcademySoftwareFoundation
Product
OpenImageIO
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-22
Advisory published
2026-10-20
Advisory updated
2026-10-22

Who should care

Defenders responsible for systems handling Cineon files, particularly those using OpenImageIO, should assess exposure and prioritize patching. This includes operators, security teams, and vulnerability management teams. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

Defenders should prioritize verifying OpenImageIO versions and applying patches due to a heap out-of-bounds read vulnerability in the Cineon Reader, potentially leading to application crashes or issues with Cineon files.

  • Potential application crashes or issues with Cineon files
  • Need for verification of OpenImageIO versions and patch application
  • Possible impact on systems handling Cineon files

Technical summary

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains a heap out-of-bounds read vulnerability in the Cineon Reader. This vulnerability is caused by an integer overflow in cineon::Codec::Read that undersizes the scanline buffer. The vulnerability can cause application crashes or issues with Cineon files. Defenders should prioritize verifying OpenImageIO versions and applying patches, focusing on systems handling Cineon files. The vulnerability has a CVSS score of 6.8 and a severity of MEDIUM.

Defensive priority

Defenders should prioritize verifying OpenImageIO versions and applying patches, focusing on systems handling Cineon files.

Recommended defensive actions

  • Verify OpenImageIO versions and apply patches
  • Focus on systems handling Cineon files
  • Monitor for potential crashes or issues with Cineon files
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the heap out-of-bounds read vulnerability in OpenImageIO. Official sources include the CVE Program and NVD. The vulnerability is caused by an integer overflow in cineon::Codec::Read that undersizes the scanline buffer. The CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113681 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113681

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113681 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113681

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113681.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5567

    Supplemental source - patch, issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5568

    Supplemental source - patch, issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/AcademySoftwareFoundation/OpenImageIO/blob/v3.0.19.0/src/cineon.imageio/libcineon/Codec.cpp

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/openimageio-before-3.0.20.0-3.1-x-before-3.1.15.0-and-3.2-x-before-3.2.0.3-beta1-cineon-reader-heap-out-of-bounds-read

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.