Description
A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulnerability affects unknown code of the file src/dds.imageio/ddsinput.cpp of the component DDS Image Handler. The manipulation results in out-of-bounds write. The attack needs to be approached locally. The exploit is now public and may be used. The patch is identified as 94ec2deec3e3bf2f2e2ff84d008e27425d626fe2. Applying a patch is advised to resolve this issue.
Published: 2026-05-01
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A buffer overflow is triggered when processing DDS image files via the ddsinput.cpp component of OpenImageIO. The write occurs beyond the bounds of the target array, potentially corrupting memory and leading to program instability or abnormal behavior. The vulnerability is categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Buffer) and CWE-787 (Out-of-Bounds Write). The CVSS score of 4.8 indicates a low severity impact.

Affected Systems

The flaw exists in AcademySoftwareFoundation OpenImageIO versions up to 3.2.0.1-dev. Any installation that parses DDS image files using the DDS Image Handler in this dataset range is affected; newer releases are not included in the advisory.

Risk and Exploitability

The exploit requires local execution and is currently available in the public domain. No EPSS score has been published, and the vulnerability is not listed in the CISA KEV catalog, reflecting a low public exploit probability. Because the attack is local, the risk is confined to systems where a privileged or unprivileged local user can provide malicious DDS files to the OpenImageIO library.

Generated by OpenCVE AI on May 2, 2026 at 07:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch commit 94ec2deec3e3bf2f2e2ff84d008e27425d626fe2 as soon as possible; this updates the ddsinput.cpp component to prevent the out-of-bounds write.
  • If a patch or newer release is not yet available, restrict the use of the DDS Image Handler to trusted users or environments where DDS files originate from verified sources, thereby limiting local attack surface.
  • Consider disabling DDS image support entirely if the functionality is not required for your workflow; this removes the vulnerability path from the application.

Generated by OpenCVE AI on May 2, 2026 at 07:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 01 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulnerability affects unknown code of the file src/dds.imageio/ddsinput.cpp of the component DDS Image Handler. The manipulation results in out-of-bounds write. The attack needs to be approached locally. The exploit is now public and may be used. The patch is identified as 94ec2deec3e3bf2f2e2ff84d008e27425d626fe2. Applying a patch is advised to resolve this issue.
Title AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write
First Time appeared Openimageio
Openimageio openimageio
Weaknesses CWE-119
CWE-787
CPEs cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*
Vendors & Products Openimageio
Openimageio openimageio
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Openimageio Openimageio
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-01T13:45:12.332Z

Reserved: 2026-05-01T07:00:25.609Z

Link: CVE-2026-7582

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-05-01T14:16:23.403

Modified: 2026-05-01T15:26:24.553

Link: CVE-2026-7582

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T08:00:14Z

Weaknesses