OpenImageIO Signed Integer Overflow in SwapRGBABytes Leads to OOB R/W (CVE-2026-4309)

Vulnerability Overview Title: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder Description: A signed 32-bit integer overflow exists in the loop index expression of the function. This function is used to calculate larger pointer offsets, and processing KAGOR DPX images with large dimensions causes a crash. Immediate Crash: When iterating with , the expression produces a large negative signed value as a pointer offset, resulting in an out-of-bounds read at . Subsequent Write: Subsequent write operations at lines 46-49 target the same wrapped offset, creating a combined out-of-bounds read/write primitive. Severity: High (CVSS v3 Base Metrics: Attack Vector Network, Attack Complexity Low, Privileges Required None, User Interaction Required, Scope Unchanged, Confidentiality High, Integrity High, Availability High) CVSS v3 Score: 8.8 / 10 CVE ID: CVE-2026-4309 Affected Versions Affected Version: 3.2.0.1-dev Fixed Versions: >= 3.0.18.0, >= 3.1.13.0, >= 3.2.0.2 Impact: - Immediate Impact: The same PoC file will cause a denial of service (DoS), regardless of whether the vulnerability has been patched. - Potential Impact: Out-of-bounds write primitive—by selecting dimensions such that wraps to a small negative value instead of the minimum, an attacker can overwrite memory preceding the buffer. Fix Recommended Fix (DPXColorConverter.cpp:41): Change the loop counter parameter from to . Code Change: Before (Before Fix): After (After Fix): Other Related Fixes: The same changes are required in (lines 115, 113), (lines 129, 124), and (lines 163, 124). should reject images where before calling . Proof-of-concept (PoC) PoC File: (~2.1 GB sparse file) Run Command: Sanitizer Output (After fixing QueryRGBBufferResizeInternal, crash at line 45 of SwapRGBABytes): ```text ./bin/ois1tool --hash poc_dpx_abgr_ood.dpx 2>&1 /home/roo/Desktop/OpenImageIO/OpenImageIO/src/lib_ois1tool/Ois1toolConverter.cpp:47:25: runtime error: load of value 1, which is not a valid value for type 'unsigned char' AddressSanitizer:DEADLYSIGNAL ================================================================= ==235875==ERROR: AddressSanitizer: SEGV on unknown address 0x5a54d248000 (pc 0x5a54d248000 bp 0x7fffffffc200 sp 0x7fffffffc000) ==235875==The signal is caused by a READ memory access. ==235875==Hint: address points to the zero page. #0 0x5a54d248000 in ois1::Convert::ToRGBInternal(ois1::Descriptor, ois1::DataSize, ois1::Characteristic, void const, void, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, in

Goal Reached Thanks to every supporter — we hit 100%!

OpenImageIO Signed Integer Overflow in SwapRGBABytes Leads to OOB R/W (CVE-2026-4309)

More from this source