CVE-2024-55194

The vulnerability consists of a heap buffer overflow in the header file /OpenImageIO/fmath.h — classified as CWE-787 (out-of-bounds write) and CWE-120 (lack of size validation during copying). An attacker can provide specially crafted input data that causes an overflow beyond the boundaries of allocated heap memory. The attack vector is network-based, requires no authentication or user interaction, which significantly increases its accessibility to potential attackers.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code remotely (RCE), as well as compromise the confidentiality, integrity, and availability of the system in full scope.

Patches available from the vendor should be applied in accordance with the references. It is recommended to monitor the project repository on GitHub at the address specified in the references and update to a version containing the fix after it is released.

OpenImageIO version v3.1.0.0dev