An integer overflow in the Cineon codec occurs when a crafted file declares a width large enough to wrap the size calculation to zero, causing the unpack routine to read beyond the bounds of a 4‑byte buffer on the heap. This out‑of‑bounds read can lead to an application crash, providing a vector for denial of service attacks. The flaw is categorized as an integer overflow (CWE‑190).

The vulnerability affects Academy Software Foundation OpenImageIO releases before 3.0.20.0, before 3.1.15.0 for the 3.1.x series, and before 3.2.0.3‑beta1 for the 3.2.x series. Users running any of these versions that process Cineon files are at risk.

The CVSS score of 6.8 indicates a moderate severity, and the EPSS score is not available, so the current exploitation probability cannot be precisely quantified. The vulnerability is not listed in CISA KEV, suggesting no widespread public exploitation is known. The likely attack vector is local or remote delivery of a malformed Cineon file, so any service or user who loads such files can be affected. Mitigations should focus on upgrading the library to a patched release or preventing the loading of suspicious files.