OpenColorIO versions before 2.5.2 contain a classic buffer overflow (CWE-120) in the parsing of LUT data lines within FileFormatSpi3D.cpp. The vulnerable code uses sscanf with the %s format specifier to copy input from a 4096-byte line buffer into a 64-byte stack buffer without bounds checking. This can lead to a stack-based buffer overflow of roughly 4000 bytes on non-Windows systems when processing maliciously crafted .spi3d files. The issue is resolved in OpenColorIO 2.5.2.

An attacker who can supply a crafted .spi3d file to OpenColorIO on a non-Windows system may trigger a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 score of 8.4 (high severity), indicating significant impact if exploited. No known exploits are reported in the wild at this time.

Upgrade OpenColorIO to version 2.5.2 or later, where this buffer overflow vulnerability is fixed. No official patch or temporary workaround is indicated. Until upgrading, avoid processing untrusted .spi3d files to reduce risk.