AC
Vendor
AcademySoftwareFoundation
75
CVEs
0
On KEV
1
New 30D
Products
OP8.8
OpenImageIO
AcademySoftwareFoundation
22 CVEs0 on KEV1 new
OP9.8
openexr
AcademySoftwareFoundation
47 CVEs0 on KEV0 new
MA7.5
MaterialX
AcademySoftwareFoundation
4 CVEs0 on KEV0 new
OP8.4
OpenColorIO
AcademySoftwareFoundation
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-113681 | OP OpenImageIO AcademySoftwareFoundation | 5.5 | Oct 20 | OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read |
| CVE-2026-65969 | OP OpenImageIO AcademySoftwareFoundation | 5.5 | Sep 18 | OpenImageIO: TGA-to-GIF palette split signed overflow causes SIGSEGV |
| CVE-2026-67549 | OP OpenImageIO AcademySoftwareFoundation | 7.6 | Sep 18 | OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write |
| CVE-2026-63638 | OP OpenImageIO AcademySoftwareFoundation | 8.3 | Sep 18 | OpenImageIO: Cineon invalid bit depth heap out-of-bounds write |
| CVE-2026-63419 | OP OpenImageIO AcademySoftwareFoundation | 7.8 | Sep 18 | OpenImageIO: IFF ZBUFFER tile read writes past caller tile buffer |
| CVE-2026-65970 | OP OpenImageIO AcademySoftwareFoundation | 5.3 | Sep 18 | OpenImageIO: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines` |
| CVE-2026-63635 | OP OpenImageIO AcademySoftwareFoundation | 5.5 | Sep 18 | OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS |
| CVE-2026-63422 | OP OpenImageIO AcademySoftwareFoundation | 7.8 | Sep 18 | OpenImageIO OpenEXR plugin partial edge tile heap out-of-bounds write |
| CVE-2026-63420 | OP OpenImageIO AcademySoftwareFoundation | 5.5 | Sep 18 | OpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row` |
| CVE-2026-59181 | OP OpenImageIO AcademySoftwareFoundation | 6.1 | Sep 18 | OpenImageIO: Stack buffer overflow in OpenImageIO Cineon reader via unchecked numberOfElements |
| CVE-2026-59156 | OP OpenImageIO AcademySoftwareFoundation | 6.5 | Sep 18 | OpenImageIO: Unbounded recursion in FITS header parser leads to stack overflow |
| CVE-2026-59956 | OP OpenImageIO AcademySoftwareFoundation | 6.1 | Sep 18 | OpenImageIO: Heap-buffer-overread in IffInput::readimg() when ZBUFFER flag is set |
| CVE-2026-50291 | OP OpenImageIO AcademySoftwareFoundation | 5.5 | Sep 17 | OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399) |
| CVE-2026-59981 | OP openexr AcademySoftwareFoundation | 7.1 | Aug 25 | OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow |
| CVE-2026-68514 | OP openexr AcademySoftwareFoundation | 5.5 | Aug 25 | OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images |
| CVE-2026-68515 | OP openexr AcademySoftwareFoundation | 7.1 | Aug 25 | OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union |
| CVE-2026-68513 | OP openexr AcademySoftwareFoundation | 7.1 | Aug 25 | OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision |
| CVE-2026-65979 | OP openexr AcademySoftwareFoundation | 6.7 | Aug 25 | OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN) |
| CVE-2026-62986 | OP openexr AcademySoftwareFoundation | 4.3 | Aug 25 | OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure |
| CVE-2026-61555 | OP openexr AcademySoftwareFoundation | 5.5 | Aug 25 | OpenEXR: Empty multiView viewFromChannelName file crash |
| CVE-2026-59985 | OP openexr AcademySoftwareFoundation | 5.5 | Aug 25 | OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32 |
| CVE-2026-59984 | OP openexr AcademySoftwareFoundation | 5.5 | Aug 25 | OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32 |
| CVE-2026-59983 | OP openexr AcademySoftwareFoundation | 5.5 | Aug 25 | OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32 |
| CVE-2026-59982 | OP openexr AcademySoftwareFoundation | 7.1 | Aug 25 | OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms |
| CVE-2026-59189 | OP openexr AcademySoftwareFoundation | 7.1 | Aug 25 | OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin |
| CVE-2026-59187 | OP openexr AcademySoftwareFoundation | 7.1 | Aug 25 | OpenEXR: exrmetrics deep pixelmode heap buffer overflow |
| CVE-2026-59186 | OP openexr AcademySoftwareFoundation | 7.1 | Aug 25 | OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds |
| CVE-2026-59184 | OP openexr AcademySoftwareFoundation | 7.1 | Aug 25 | OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write |
| CVE-2026-59183 | OP openexr AcademySoftwareFoundation | 5.5 | Aug 25 | OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding |
| CVE-2026-55373 | OP openexr AcademySoftwareFoundation | 6.2 | Aug 25 | OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts |
| CVE-2026-55371 | OP openexr AcademySoftwareFoundation | 6.9 | Aug 25 | OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length |
| CVE-2026-55059 | OP openexr AcademySoftwareFoundation | 6.1 | Aug 25 | OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability |
| CVE-2026-54920 | OP openexr AcademySoftwareFoundation | 0.0 | Aug 25 | OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize |
| CVE-2026-53532 | OP openexr AcademySoftwareFoundation | 7.1 | Aug 24 | OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) |
| CVE-2026-68516 | OP openexr AcademySoftwareFoundation | 6.5 | Aug 24 | OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow |
| CVE-2026-42450 | OP OpenColorIO AcademySoftwareFoundation | 8.4 | Jun 24 | OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser |
| CVE-2026-45696 | OP openexr AcademySoftwareFoundation | 6.5 | Jun 18 | OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS) |
| CVE-2026-44663 | OP openexr AcademySoftwareFoundation | 7.1 | Jun 18 | OpenEXR: Integer overflow in the HTJ2K decoder leads to heap-buffer-overflow |
| CVE-2026-43903 | OP OpenImageIO AcademySoftwareFoundation | 7.8 | May 14 | OpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSERT bounds checks are no-ops in release builds |
| CVE-2026-43904 | OP OpenImageIO AcademySoftwareFoundation | 7.8 | May 14 | OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width |
| CVE-2026-43905 | OP OpenImageIO AcademySoftwareFoundation | 7.8 | May 14 | OpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation |
| CVE-2026-43996 | OP OpenImageIO AcademySoftwareFoundation | 5.5 | May 14 | OpenImageIO: Integer wraparound in bounds check of decode_pixel leads to out-of-bounds read in TGA paletted image decoder |
| CVE-2026-43907 | OP OpenImageIO AcademySoftwareFoundation | 8.3 | May 14 | OpenImageIO: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR) |
| CVE-2026-43908 | OP OpenImageIO AcademySoftwareFoundation | 8.8 | May 14 | OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder |
| CVE-2026-43909 | OP OpenImageIO AcademySoftwareFoundation | 8.8 | May 14 | OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder |
| CVE-2026-43906 | OP OpenImageIO AcademySoftwareFoundation | 7.8 | May 14 | OpenImageIO: HEIF Heap overflow |
| CVE-2026-42217 | OP openexr AcademySoftwareFoundation | 9.8 | May 7 | OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`) |
| CVE-2026-42216 | OP openexr AcademySoftwareFoundation | 9.1 | May 7 | OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion |
| CVE-2026-41142 | OP openexr AcademySoftwareFoundation | 8.8 | May 7 | OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API |
| CVE-2026-40250 | OP openexr AcademySoftwareFoundation | 7.1 | Apr 21 | OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589) |
| CVE-2026-40244 | OP openexr AcademySoftwareFoundation | 7.1 | Apr 21 | OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589) |
| CVE-2026-39886 | OP openexr AcademySoftwareFoundation | 5.3 | Apr 21 | OpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl() |
| CVE-2026-34589 | OP openexr AcademySoftwareFoundation | 5.0 | Apr 6 | OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write |
| CVE-2026-34588 | OP openexr AcademySoftwareFoundation | 7.8 | Apr 6 | OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write |
| CVE-2026-34380 | OP openexr AcademySoftwareFoundation | 5.9 | Apr 6 | OpenEXR has a signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression |
| CVE-2026-34379 | OP openexr AcademySoftwareFoundation | 7.1 | Apr 6 | OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression) |
| CVE-2026-34378 | OP openexr AcademySoftwareFoundation | 6.5 | Apr 6 | OpenEXR has a signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x |
| CVE-2026-34543 | OP openexr AcademySoftwareFoundation | 7.5 | Apr 1 | OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl) |
| CVE-2026-34544 | OP openexr AcademySoftwareFoundation | 7.3 | Apr 1 | OpenEXR: integer overflow to OOB write in uncompress_b44_impl() |
| CVE-2026-34545 | OP openexr AcademySoftwareFoundation | 7.3 | Apr 1 | OpenEXR: integer overflow lead to OOB in HTJ2K decoder |