OpenImageIO’s SGI RLE decoder has a heap buffer overflow caused by the OIIO_DASSERT macro being converted to a no‑op in release builds. The bounds check that should guard the RLE count is omitted, so a crafted SGI file with an excessively large RLE count can write past the end of an internal buffer and crash the application. The vulnerability is limited to an application crash and does not confer the ability to execute arbitrary code.

The affected product is OpenImageIO from the Academy Software Foundation. Versions earlier than 3.0.18.0 and 3.1.13.0 contain the flaw; these releases were made available before the official fix was implemented.

The CVSS score of 8.4 classifies this as a high‑severity flaw. Attackers need to supply a malicious SGI file that OpenImageIO processes, which can be delivered in a local or remote context depending on how the application handles image input. The EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the presence of a vulnerable OpenImageIO build with release configuration, where OIIO_DASSERT guarantees are stripped out.