CVE-2026-50291

MediumCVSS 5.5/10Last modified Sep 29, 2026

Description

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. BmpInput::read_native_scanline then performs an invalid palette read while decoding an RLE-compressed scanline, causing a process crash and denial of service. This issue is fixed in versions 3.0.16.0 and 3.1.11.0.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
AcademySoftwareFoundationOpenImageIO< 3.0.16.0; >= 3.1.0.0, < 3.1.11.0

References

Timeline

Published
Sep 17, 2026
Last modified
Sep 29, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-502929.8In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrCVE-2026-502937.8Use after free in Windows Internal Task Bar allows an authorized attacker to elevate privileges locally.CVE-2026-502946.2Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose infCVE-2026-502955.5Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally.CVE-2026-502967.0Use after free in Graphics Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-502977.0Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-502986.8Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-502996.8Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack.CVE-2026-50309.8A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHost of the file /cgi-bCVE-2026-503005.5Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-503018.4Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-503026.5Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a networ
CVE-2026-50291: Medium severity, CVSS 5.5 | Vulnix