OpenImageIO, a toolset for handling image files in VFX and animation workflows, contains a heap-based buffer overflow vulnerability (CWE-122) in its HEIF image decoder. Specifically, crafted HEIF images with subimage metadata mismatches can cause out-of-bounds writes to heap memory, resulting in memory corruption. This vulnerability affects versions prior to 3.0.18.0 and versions from 3.1.4.0-beta up to but not including 3.1.13.0. The issue is resolved in versions 3.0.18.0 and 3.1.13.0. The CVSS 4.0 vector indicates local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to memory corruption and potentially arbitrary code execution on affected systems running vulnerable versions of OpenImageIO. This could compromise the confidentiality, integrity, and availability of the system processing malicious HEIF images. No known exploits in the wild have been reported at this time.

Upgrade OpenImageIO to version 3.0.18.0 or later, or to version 3.1.13.0 or later, where this vulnerability is fixed. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified.