CVE-2026-43908
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
- Affected products
- Linuxmint, Openimageio, Ubuntu
- Openimageio
- < 3.0.18.0, 3.1.13.0, 3.2.0.0, 3.2.0.2
- Fix
- Available
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 0.4% (30th percentile)
- Weakness
- CWE-787, CWE-190
- NVD status
- Analyzed
- Published
- 2026-05-14
CVE-2026-43908 at NVD
No indexed exploits for CVE-2026-43908 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-43908 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.