CVE-2026-113681

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-113681
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113681.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-113681
Published
2026-10-20T15:40:41Z
Modified
2026-10-21T09:40:59Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read
Details

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-190"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113681.json"
}
References

Affected packages

Git / github.com/academysoftwarefoundation/openimageio

Affected ranges

Type
GIT
Repo
https://github.com/academysoftwarefoundation/openimageio
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
49696331774f2da1f136c4217e23c1e4d920a376
Fixed
cbe57bc005678ca310835473568121719861734c
Introduced
a0940a9f1e4a8ff20edc9d550a4dea4723d1aa58
Fixed
45414c1aedcd3cc98244b4c5802ec53e91976f70
Fixed
07e3c3e0373551c57e7d8e01353deaa4b3646613
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "3.0.20.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "3.1.0.0"
                },
                {
                    "fixed":  "3.1.15.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "3.2.0.0-dev"
                },
                {
                    "fixed":  "3.2.0.3-beta1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "07e3c3e0373551c57e7d8e01353deaa4b3646613"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Arnold-3.*
Arnold-3.4.72.0
Release-0.*
Release-0.10.0
Release-1.*
Release-1.0.0
Release-1.0.1
Release-1.1.0
Release-1.1.0-beta1
Release-1.1.0-beta2
Release-1.1.0-beta3
Release-1.1.0-beta4
Release-1.1.1
Release-1.3.0-dev
Release-1.3.1-dev
Release-1.3.2-dev
Release-1.3.3-dev
Release-1.3.4-dev
Release-1.3.5
Release-1.3.5-dev
Release-1.3.6-dev
Release-1.4.1dev
Release-1.4.2dev
Release-1.4.3dev
Release-1.4.4dev
Release-1.4.5dev
Release-1.4.6RC1
Release-1.5.0dev
Release-1.5.1dev
Release-1.5.2dev
Release-1.5.3dev
Release-1.5.4dev-pre-SIMD
Release-1.5.5dev
Release-1.5.6dev
Release-1.5.7dev
Release-1.6.1dev
Release-1.6.2dev
Release-1.6.3dev
Release-1.6.4dev
Release-1.6.6beta
Release-1.7.0dev
Release-1.7.1dev
Release-1.7.2dev
Release-1.7.3dev
Release-1.7.4dev
Release-1.7.5beta
Release-1.7.6RC1
Release-1.8.0dev
Release-1.8.1dev
Release-1.8.2dev
Release-1.8.3dev
Release-1.8.4dev
Release-1.9.1dev
Release-1.9.2dev
Release-1.9.3dev
Release-1.9.4dev
Release-2.*
Release-2.0.0-beta1
Release-2.0.1-RC1
Release-2.1.0-dev
Release-2.1.1-dev
Release-2.1.2-dev
Release-2.1.3-dev
Release-2.1.4.0-dev
Release-2.1.5.0-dev
Release-2.1.7-beta
Release-2.1.8.0-RC1
Release-2.2.0.0-dev
Release-2.2.1.0-dev
Release-2.2.1.1-dev
Release-2.2.2.0-dev
Release-2.2.3.0-dev
Release-2.3.0.0-dev
Release-2.3.1.0-dev
Release-2.3.2.0-dev
Release-2.3.3.0-dev
Release-2.3.4.0-dev
arnold-3.*
arnold-3.4.71.0
spi-Arn3.*
spi-Arn3.4.71.0
spi-Arn3.4.72.0
spi-Arn3.4.73.6
spi-Arn3.4.73.7
spi-Arn3.5.0.0
spi-Arn3.5.10.0
spi-Arn3.5.11.0
spi-Arn3.5.12.0
spi-Arn3.5.13.1
spi-Arn3.5.14.0
spi-Arn3.5.16.0
spi-Arn3.5.2.0
spi-Arn3.5.24.0
spi-Arn3.5.25.0
spi-Arn3.5.26.0
spi-Arn3.5.28.0
spi-Arn3.5.31.0
spi-Arn3.5.35.0
spi-Arn3.5.37.0
spi-Arn3.5.41.0
spi-Arn3.5.45.0
spi-Arn3.5.45.1
spi-Arn3.5.48.0
spi-Arn3.5.5.0
spi-Arn3.5.50.0
spi-Arn3.5.66.0
spi-Arn3.5.68.0
spi-Arn3.5.75.0
spi-Arn3.5.8.0
spi-Arn3.5.82.0
spi-Arn3.5.90.0
spi-Arn3.5.91.0
spi-Arn3.5.93.10
spi-Arn3.6.18.0
spi-Arn3.6.21.3
spi-Arn3.6.27.0
spi-Arn3.6.33.4
spi-Arn3.6.36.0
spi-Arn3.6.64.6
spi-Arn3.6.69.3
spi-Arn3.6.7.1
spi-Arn3.6.72.1
spi-Arn3.7.23.3
spi-Arn3.7.25.0
spi-Arn3.7.42.0
Other
spi-SpComp2-v20
spi-SpComp2-v9
spi-spcomp2-release-38.*
spi-spcomp2-release-38.0
spi-spcomp2-release-39.*
spi-spcomp2-release-39.1
spi-spcomp2-release-41.*
spi-spcomp2-release-41.0
spi-spcomp2-release-42.*
spi-spcomp2-release-42.0-rhel7
spi-spcomp2-release-43.*
spi-spcomp2-release-43.0
spi-spcomp2-release-44.*
spi-spcomp2-release-44.0
spi-spcomp2-release-44.1
spi-spcomp2-release-44.2
spi-spcomp2-release-45.*
spi-spcomp2-release-45.0
spi-spcomp2-release-45.1
spi-spcomp2-release-45.3
spi-spcomp2-release-45.4
spi-spcomp2-release-47.*
spi-spcomp2-release-47.0
spi-spcomp2-release-48.*
spi-spcomp2-release-48.0
spi-spcomp2-release-49.*
spi-spcomp2-release-49.1
spi-v7-Arn3.*
spi-v7-Arn3.4.73.3
spi-v8-Arn3.*
spi-v8-Arn3.4.73.6
spiArn-3.*
spiArn-3.6.74.0
spiArn-3.6.84.0
spiArn-3.6.86.0
spiArn-3.6.94.0
spiArn3.*
spiArn3.5.45.0
spiArn3.5.45.1
spiArn3.5.48.0
spiArn3.5.50.0
spiArn3.5.66.0
spiArn3.5.68.0
spiArn3.5.75.0
spiArn3.5.82.0
v2.*
v2.3.5.0-dev
v2.3.6.0-dev
v2.4.0.0-dev
v2.4.0.1-dev
v2.4.0.2-dev
v2.4.0.3-dev
v2.4.1.1-dev
v2.4.2.0-dev
v2.4.2.1-dev
v2.4.2.2-dev
v2.5.0.0-dev
v2.5.2.0-dev
v2.6.1.0-dev
v2.6.2.0-dev
v2.6.5.0-dev
v3.*
v3.0.0.0-beta1
v3.0.0.1-beta2
v3.0.0.2-RC1
v3.0.0.3
v3.0.1.0
v3.0.10.0
v3.0.10.1
v3.0.11.0
v3.0.12.0
v3.0.13.0
v3.0.14.0
v3.0.15.0
v3.0.16.0
v3.0.17.0
v3.0.18.0
v3.0.18.1
v3.0.19.0
v3.0.19.1
v3.0.2.0
v3.0.3.0
v3.0.3.1
v3.0.4.0
v3.0.5.0
v3.0.6.0
v3.0.6.1
v3.0.7.0
v3.0.8.0
v3.0.8.1
v3.0.9.0
v3.1.10.0
v3.1.11.0
v3.1.12.0
v3.1.13.0
v3.1.13.1
v3.1.14.0
v3.1.14.1
v3.1.4.0-beta
v3.1.5.0-beta2
v3.1.6.0-rc1
v3.1.6.1
v3.1.6.2
v3.1.7.0
v3.1.8.0
v3.1.9.0
v3.2.0.0-dev
v3.2.0.2-dev

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113681.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "99597871854014780197708863551975218799",
            "length":  1153
        },
        "id":  "CVE-2026-113681-0bcb1bc0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/dpx.imageio/libdpx/ReaderInternal.h",
            "function":  "ReadPacked"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "217194631032316723526521456751361170508",
            "length":  11560
        },
        "id":  "CVE-2026-113681-10be3fe9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/dpx.imageio/dpxinput.cpp",
            "function":  "DPXInput::seek_subimage"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "159383907641676986235514974437055877378",
            "length":  1055
        },
        "id":  "CVE-2026-113681-179a5cbe",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/cineon.imageio/libcineon/ReaderInternal.h",
            "function":  "ReadPacked"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "226842921167208664961297278495708168590",
            "length":  649
        },
        "id":  "CVE-2026-113681-2d611100",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/cineon.imageio/libcineon/ReaderInternal.h",
            "function":  "UnPackPacked"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "63261060584689045517533902988162069859",
            "length":  1505
        },
        "id":  "CVE-2026-113681-46fc892f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/dpx.imageio/libdpx/ReaderInternal.h",
            "function":  "Read10bitFilled"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "205248434568906500864405272665692934272",
            "length":  8157
        },
        "id":  "CVE-2026-113681-4768afaa",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/cineon.imageio/cineoninput.cpp",
            "function":  "CineonInput::open"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "73009772443616113813824781961176209634",
                "277539097713233560446754560471704682153",
                "141651815738782513075237132764367277316"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-113681-62f691b1",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/cineon.imageio/cineoninput.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "250990733816713015213494668188756524048",
                "80290667998058803732169410784066712004",
                "316842338331577171803406516095652994978",
                "96384737335040424670306658035127419859",
                "336607821164711997278220707332492778882",
                "50325439336038162818757000483984340496",
                "116218482510577298406629073607625660402",
                "285684354449724412990799801461403863671",
                "306999254617417059952900527548992843455",
                "100920958407931439199910240548523649242",
                "215811328259551984398811176244327804239",
                "264508968043254272894495249348002578320",
                "168770745793280118114987573973428362039",
                "120900527822192019949524577236743255757",
                "77175170625917834092894231079386451896",
                "322499660555312168918994814574671200889",
                "53023120591064215667972663075068954460",
                "214426258158080898801565717699436841019",
                "63267190098207372674557697890644782191",
                "57019373775289048281615783933530528302",
                "16832237364580389971787270062839899624",
                "95262800908107383381761655574659369366",
                "34225370326802070823406487232108059063",
                "251748489113791666062058328398855776300"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-113681-80c26bab",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/cineon.imageio/libcineon/ReaderInternal.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "316053618047513812111720718114952003476",
                "95253360493917550267669100146405739275",
                "173213689123713846148559884666508154068",
                "235598000382156208242642855327486448278",
                "108804799885373215685016421485947643550",
                "174803238094656551207960706256247780662",
                "166694446489541661533990362491838766363",
                "220661395003470326388209803467436550838",
                "292839799698658838385913302114008101245",
                "80290667998058803732169410784066712004",
                "316842338331577171803406516095652994978",
                "96384737335040424670306658035127419859",
                "336607821164711997278220707332492778882",
                "96378096731945847403578058392753562655",
                "218377355790456407004556387065756947691",
                "276078703915950418208790684306138196613",
                "123588432073333696354273939241405109420",
                "310823779286481088388663508838219002354",
                "324727514956779686917737104469313301077",
                "176875070942773774302110623965210524590",
                "339923348119929252606059010380486064323",
                "316121103846578711125979695512372911534",
                "6390950603912552573064989321723808687",
                "63267190098207372674557697890644782191",
                "305007635789490611507390443851610724117",
                "169849389671287573871835040763470835432",
                "195322715879942617857121662942817263520",
                "199638569118620797067586679637033735951",
                "116358289431917708881340325609532595675",
                "251748489113791666062058328398855776300"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-113681-be01acab",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/dpx.imageio/libdpx/ReaderInternal.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "300094481514907975833309960809145654293",
            "length":  668
        },
        "id":  "CVE-2026-113681-c114a9f5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/dpx.imageio/libdpx/ReaderInternal.h",
            "function":  "UnPackPacked"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "213666335677191533011247524095785567860",
            "length":  1550
        },
        "id":  "CVE-2026-113681-d240c6b9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/dpx.imageio/libdpx/Reader.cpp",
            "function":  "dpx::Reader::ReadBlock"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "150922089608317239138671249209358902976",
                "334436843453256404521439355329356666080",
                "36137753709117728208276635234265036034",
                "143951352520903357313389421332242723938",
                "123692376541450469884590597213555634402",
                "286132657086012133087321331212959784822"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-113681-eaa44bdb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613",
        "target":  {
            "file":  "src/dpx.imageio/libdpx/Reader.cpp"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T09:40:59Z"