GHSA-m86r-wr74-693h

Source

https://github.com/advisories/GHSA-m86r-wr74-693h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-m86r-wr74-693h/GHSA-m86r-wr74-693h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m86r-wr74-693h

Aliases

Published

2026-01-11T12:30:27Z

Modified

2026-07-07T17:56:19Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

AcademySoftwareFoundation OpenColorIO has an out-of-bounds vulnerability

Details

A vulnerability was found in AcademySoftwareFoundation OpenColorIO up to 2.5.0. This issue affects the function ConvertToRegularExpression of the file src/OpenColorIO/FileRules.cpp. Performing a manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named ebdbb75123c9d5f4643e041314e2bc988a13f20d. To fix this issue, it is recommended to deploy a patch. The fix was added to the 2.5.1 milestone.

Database specific

{
    "cwe_ids": [
        "CWE-119",
        "CWE-125"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-13T19:06:56Z",
    "nvd_published_at": "2026-01-11T11:15:49Z",
    "severity": "LOW"
}

References

Affected packages

PyPI / opencolorio

Package

Name: opencolorio; View open source insights on deps.dev
Purl: pkg:pypi/opencolorio

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.5.1

Affected versions

2.*

2.1.0

2.1.1

2.1.2

2.1.3

2.2.0

2.2.1

2.3.0

2.3.1

2.3.2

2.4.0

2.4.1

2.4.2

2.5.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-m86r-wr74-693h/GHSA-m86r-wr74-693h.json"