OpenImageIO CVE-2026-43907: Heap Overflow in DPX Processing

The National Vulnerability Database (NVD) has detailed CVE-2026-43907, a high-severity vulnerability (CVSS 8.3) in OpenImageIO, a critical toolset for VFX and animation image processing. This flaw, present in versions prior to 3.0.18.0 and 3.1.13.0, stems from a signed integer overflow within the QueryRGBBufferSizeInternal() function when handling crafted DPX image files. Specifically, negative multipliers used for buffer size computation can overflow INT_MIN for sufficiently large pixel counts, wrapping to a small positive value.

This incorrect positive value is then interpreted by dpxinput.cpp as a legitimate, albeit undersized, buffer requirement. Consequently, an undersized heap buffer is allocated, leading to a heap-based out-of-bounds write when full image data is subsequently loaded via fread. An attacker can exploit this by distributing a specially crafted DPX file, triggering a denial of service (application crash) or, more critically, achieving arbitrary code execution through heap corruption in any application utilizing OpenImageIO to process pixel data.

This is a classic heap overflow scenario, demonstrating how seemingly innocuous integer arithmetic can lead to catastrophic memory corruption. Defenders must recognize that applications handling image files from untrusted sources are prime targets. The fix is available in OpenImageIO versions 3.0.18.0 and 3.1.13.0, addressing both CWE-190 (Integer Overflow or Wraparound) and CWE-787 (Out-of-bounds Write). Patching is not optional; it’s a direct counter to potential RCE.