OpenImageIO’s Softimage PIC image decoder does not clamp the run length when decoding RLE data, allowing an attacker to craft a .pic file that overflows a heap buffer by up to 65,535 bytes. This flaw is a classic buffer overflow (CWE‑787) that can corrupt memory and potentially lead to arbitrary code execution or a denial‑of‑service condition when the malformed image is processed.

AcademySoftwareFoundation OpenImageIO versions earlier than 3.0.18.0 and 3.1.13.0 are affected. The vulnerability resides in the softimageinput.cpp module, which handles Softimage PIC image files and fails to limit the RLE run length to the remaining scanline width.

The CVSS score of 8.4 indicates a high severity; the exploit probability is currently undocumented, but the lack of an entry in the KEV catalog and the nature of the vulnerability suggest that attackers could trigger the overflow by delivering a malicious .pic file to any application that processes image uploads, potentially leading to remote code execution if the vulnerability is exploitable in that context. The likely attack vector involves supplying or uploading a crafted .pic file to a vulnerable system. The vulnerability remains unpatched in older OpenImageIO releases, thus requiring immediate action to mitigate the risk of an attacker executing code or causing a crash.