CVE-2026-113681: Integer Overflow or Wraparound in AcademySoftwareFoundation OpenImageIO

CVE-2026-113681 describes an integer overflow or wraparound in the cineon::Codec::Read function of OpenImageIO. The vulnerability arises when a crafted Cineon file declares a very large width, causing the size calculation for the scanline buffer to wrap around to zero. This results in an undersized buffer allocation, and subsequent UnPackPacked operations read past the allocated 4-byte buffer, causing a heap out-of-bounds read and application crash. The affected versions are OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1.

The vulnerability allows an attacker to supply a specially crafted Cineon file that triggers a heap out-of-bounds read, which can crash the application processing the file. There is no indication of privilege escalation or code execution in the provided data. The CVSS 4.0 score is 6.8 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction needed, and high impact on availability.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, avoid processing untrusted Cineon files or implement input validation to restrict file widths to safe values.