A signed 32‑bit integer overflow occurs in OpenImageIO's SwapRGBABytes() function when decoding DPX ABGR images with large dimensions. The overflow causes i * 4 to wrap around, resulting in an out‑of‑bounds read followed by writes to the same negative offset, giving the application a combined OOB read and write primitive that can crash the program.

The vulnerability affects the AcademySoftwareFoundation OpenImageIO library in all releases prior to 3.0.18.0 and 3.1.13.0. Any installation that processes DPX ABGR images with large dimensions using these versions is exposed. The problem is fixed in 3.0.18.0 and 3.1.13.0.

The CVSS score of 8.8 signals a high‑severity flaw. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. An attacker can trigger the issue by providing a maliciously dimensioned DPX file, which may be supplied locally or indirectly through a media‑processing pipeline, leading to memory corruption or denial of service.