OpenImageIO is a widely used toolset for reading, writing, and manipulating image files in VFX and animation pipelines. A signed integer overflow occurs in the function QueryRGBBufferSizeInternal() in DPXColorConverter.cpp; the overflow results from using 32‑bit signed arithmetic with negative multipliers for certain DPX descriptors. When the pixel count is large enough, the multiplication wraps around to a small positive value, which the caller interprets as a safe buffer size. The library then allocates a buffer that is far too small and writes the entire image into it, creating a heap out‑of‑bounds write. An attacker can exploit this by crafting a malicious DPX file, causing the application that reads the file to crash or, worse, to execute arbitrary code through heap corruption. The vulnerability exists in all OpenImageIO releases older than versions 3.0.18.0 and 3.1.13.0, which are commonly deployed in animation and visual‑effects workflows.

The affected product is OpenImageIO from the Academy Software Foundation. Any application that embeds or links to this library and processes DPX image files—particularly those using the kCbYCr or kABGR color descriptors—could be impacted. Versions released before 3.0.18.0 and before 3.1.13.0 are vulnerable and require upgrade to the patched releases cited above.

The CVSS score of 8.3 highlights a severe vulnerability. The EPSS score is currently not available, and the issue is not listed in CISA’s KEV catalog, indicating no known widespread exploitation at this time. However, because the flaw manifests only when a specially crafted DPX file is processed, a likely attack vector is the delivery of malicious image files through any channel that the application reads from—whether local, network, or file‑system based. Exploitation requires the application to run with sufficient privileges to execute heap‑corrupted code. Given the high impact and the lack of mitigations in affected releases, the risk is significant for environments that routinely process DPX imagery.