Low severity · published Jan 11, 2026
CVE-2025-15506
AcademySoftwareFoundation OpenColorIO FileRules.cpp ConvertToRegularExpression out-of-bounds
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in AcademySoftwareFoundation OpenColorIO up to 2.5.0. This issue affects the function ConvertToRegularExpression of the file src/OpenColorIO/FileRules.cpp. Performing a manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named ebdbb75123c9d5f4643e041314e2bc988a13f20d. To fix this issue, it is recommended to deploy a patch. The fix was added to the 2.5.1 milestone.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenColorIO · AcademySoftwareFoundation
2.0; 2.1; 2.2; 2.3; 2.4; 2.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15506
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15506
github.com
https://github.com/AcademySoftwareFoundation/OpenColorIO/
github.com
https://github.com/AcademySoftwareFoundation/OpenColorIO/issues/2228
github.com
https://github.com/AcademySoftwareFoundation/OpenColorIO/milestone/11
github.com
https://github.com/AcademySoftwareFoundation/OpenColorIO/pull/2231
github.com
https://github.com/cozdas/OpenColorIO/commit/ebdbb75123c9d5f4643e041314e2bc988a13f20d
github.com
https://github.com/oneafter/1225/blob/main/uaf
More from OpenColorIO
8.4
CVE-2026-42450
OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser