A heap out-of-bounds write vulnerability in AcademySoftwareFoundation OpenImageIO exposes systems to memory corruption and potential code execution when processing malicious image files.

This vulnerability is an out-of-bounds write (CWE-787) occurring within the Cineon image parsing logic of the library. An unauthenticated attacker can trigger this flaw by providing a crafted image with an unsupported bit depth, causing the application to write data beyond allocated memory buffers during scanline reading.

The vulnerability carries a CVSS score of 8.3, reflecting its potential for high impact on data integrity and system availability. Successful exploitation could lead to arbitrary memory corruption, which may result in application crashes or, in specific environments, facilitate remote code execution. This poses a significant risk to production pipelines in VFX and animation environments that rely on automated image processing workflows.

Immediate Action: Update OpenImageIO to versions 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 immediately to incorporate the necessary memory safety checks.

Proactive Monitoring: Monitor application logs for segmentation faults or abnormal termination of image processing services, which may indicate attempted exploitation.

Compensating Controls: Implement strict input validation or sandboxing for image processing services to isolate potentially malicious files from the core system memory.

Public Exploit Available: No

Given the high CVSS severity and the critical nature of image parsing libraries in VFX production pipelines, organizations must prioritize patching. Update all instances of OpenImageIO to the specified fixed versions to prevent potential memory corruption attacks. If immediate patching is not possible, ensure that image parsing services are executed with the least privilege necessary to limit the impact of a potential compromise.