OpenImageIO versions before 3.0.18.0 and between 3.1.4.0-beta and 3.1.13.0 contain an out-of-bounds write vulnerability (CWE-787) in the RLE decoding implementation within softimageinput.cpp. Specifically, the mixed and pure RLE paths fail to clamp run lengths to the remaining scanline width before writing pixels, unlike the raw packet path which correctly clamps using std::min. This improper bounds checking allows a crafted .pic file to trigger a heap overflow of up to 65535 bytes. The vulnerability is addressed in versions 3.0.18.0 and 3.1.13.0 of OpenImageIO.

Successful exploitation of this vulnerability can cause a heap overflow, potentially leading to memory corruption. This may result in application crashes or could be leveraged for arbitrary code execution or denial of service. The CVSS 4.0 score of 8.4 reflects high impact on confidentiality, integrity, and availability with low attack complexity but requiring user interaction and local access vector.

This vulnerability is fixed in OpenImageIO versions 3.0.18.0 and 3.1.13.0. Users and administrators should upgrade to these or later versions to remediate the issue. No official patch or temporary fix is indicated beyond upgrading. Since this is not a cloud service, remediation depends on applying the vendor's fixed versions. Patch status is confirmed by the vendor advisory embedded in the description.