OpenImageIO contains a heap-based buffer overflow in its HEIF decoder. A crafted HEIF image can trigger an out-of-bounds write that corrupts memory and enables an attacker to execute arbitrary code.

All releases of OpenImageIO older than 3.0.18.0 and 3.1.13.0, produced by the Academy Software Foundation and used in VFX and animation image processing pipelines, are affected.

The CVSS score is 8.5, indicating high severity. No EPSS data is available so the exploitation probability is unknown, and the vulnerability is not listed in CISA's KEV catalog. The attacker can exploit the flaw by providing a malicious HEIF file that the software processes—most likely via a remote upload or an embedded link in an email. The attack vector is inferred as remote image ingestion.