« Volver al listado

CVE-2026-43996

Estado: ModificadaMedia (5.5)—

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, the bounds check in TGAInput::decode_pixel computes k + palbytespp as unsigned 32-bit arithmetic. When k = 0xFFFFFFFC and palbytespp = 4, the addition wraps to 0, which compares less than palette_alloc_size and passes the check. The subsequent palette access uses the unwrapped k (0xFFFFFFFC) as the index, reading ~4 GB past the start of the palette buffer — SEGV. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openimageio — Openimageio

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-43996",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-43996",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-16T00:52:59.068131Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "AcademySoftwareFoundation",
          "product": "OpenImageIO",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.0.18.0"
            },
            {
              "status": "affected",
              "version": ">= 3.1.4.0-beta, < 3.1.13.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-14T20:17:07.300",
  "references": [
    {
      "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-mq8j-73c4-cr55",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-mq8j-73c4-cr55",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, the bounds check in TGAInput::decode_pixel computes k + palbytespp as unsigned 32-bit arithmetic. When k = 0xFFFFFFFC and palbytespp = 4, the addition wraps to 0, which compares less than palette_alloc_size and passes the check. The subsequent palette access uses the unwrapped k (0xFFFFFFFC) as the index, reading ~4 GB past the start of the palette buffer — SEGV. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0."
    }
  ],
  "lastModified": "2026-06-17T10:50:10.833",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90B206C1-E7DB-4175-8077-C76D5C8533AF",
              "versionEndExcluding": "3.0.18.0"
            },
            {
              "criteria": "cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1F5BCA2-D6C4-4F7B-8D2A-EBD19A022467",
              "versionEndExcluding": "3.1.13.0",
              "versionStartIncluding": "3.1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:openimageio:openimageio:3.2.0.0:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F43FE0AC-4CFC-485D-8370-37336EB2CEA0"
            },
            {
              "criteria": "cpe:2.3:a:openimageio:openimageio:3.2.0.2:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "450296D8-74F5-4847-8433-FE3DFB16C58E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}