CVE-2026-42450 AcademySoftwareFoundation CVE debrief

Who should care

Defenders responsible for systems or applications that process .spi3d files using OpenColorIO should assess exposure and prioritize patching or mitigation measures. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify OpenColorIO version usage and apply patches or mitigations as necessary.

Why it matters

CVE-2026-42450 is a high-severity buffer overflow vulnerability in OpenColorIO that requires prompt attention from defenders responsible for systems or applications processing .spi3d files. The vulnerability allows for potential arbitrary code execution and disruption of critical workflows. Defenders should assess exposure, verify OpenColorIO version usage, and apply patches or mitigations as necessary.

• Potential buffer overflow leading to arbitrary code execution
• Possible disruption of visual effects and animation workflows
• Need for verification of OpenColorIO version usage
• Potential impact on systems processing .spi3d files

Technical summary

The vulnerability exists in `FileFormatSpi3D.cpp:163` of OpenColorIO, where `sscanf` is used with `%s` into 64-byte stack buffers when parsing LUT data lines. This allows a crafted .spi3d file to overflow the buffer by approximately 4000 bytes on non-Windows systems. The issue is fixed in OpenColorIO version 2.5.2. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The vulnerability allows for potential arbitrary code execution and disruption of critical workflows.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where .spi3d files are processed.

Recommended defensive actions

• Assess exposure to .spi3d file processing in your environment
• Verify if OpenColorIO versions prior to 2.5.2 are in use
• Apply patch or mitigation measures as necessary
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed to exist in OpenColorIO versions prior to 2.5.2. The fix is available in version 2.5.2. However, the exact scope of affected versions and potential exploitation remains limited by the information provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.