OpenImageIO versions prior to 3.0.18.0 and 3.1.13.0 contain an out-of-bounds write vulnerability (CWE-787) in the RLE decoding implementation within softimageinput.cpp. Specifically, the mixed RLE and pure RLE paths do not clamp the run length to the remaining scanline width before writing pixels, unlike the raw packet path which correctly clamps using std::min. This flaw allows a crafted .pic image file to trigger a heap overflow of up to 65535 bytes. The vulnerability is addressed by fixes included in OpenImageIO 3.0.18.0 and 3.1.13.0.

Successful exploitation of this vulnerability can cause a heap overflow, potentially leading to memory corruption, application crashes, or arbitrary code execution within the context of the user running OpenImageIO. The CVSS 4.0 vector indicates local attack vector with low attack complexity but requires user interaction, and the vulnerability impacts confidentiality, integrity, and availability with high severity.

This vulnerability is fixed in OpenImageIO versions 3.0.18.0 and 3.1.13.0. Users and administrators should upgrade affected OpenImageIO installations to at least these versions to remediate the issue. Patch status is not explicitly stated beyond the fixed versions, so verify with the vendor or official OpenImageIO release notes for confirmation. No additional vendor advisory content is provided.