OpenColorIO is a color management framework for visual effects and animation. In version 2.5.2 and earlier, the Spi3D (.spi3d) LUT parser reads data lines using `sscanf` with the `%s` format specifier into a 64‑byte stack buffer located at line 163 in FileFormatSpi3D.cpp, while the input originates from a 4096‑byte `lineBuffer`. A crafted .spi3d file can overflow the stack by approximately 4000 bytes on non‑Windows platforms, potentially leading to memory corruption and arbitrary code execution. The flaw is identified as CWE‑120 and has been mitigated in OpenColorIO 2.5.2.

Vendors: AcademySoftwareFoundation OpenColorIO. Affected versions are all releases prior to 2.5.2. Users of OpenColorIO 2.5.1 or earlier that parse Spi3D LUT files are potentially vulnerable.

The vulnerability has a CVSS score of 8.4, indicating high severity. The EPSS score is not available and the flaw is not listed in CISA's KEV catalog. Exploitation requires access to the file system to supply a malicious .spi3d file, and the application must parse such files. In environments where untrusted files are processed, the risk is high; in tightly controlled workflows the threat is lower. The lack of a public exploit does not diminish the potential risk, and the high CVSS warrants prompt attention.