OpenImageIO, a toolset for image file manipulation used in VFX and animation, contains an integer overflow vulnerability (CWE-190) in the ConvertCbYCrYToRGB() function. Specifically, a signed 32-bit integer overflow in the pixel-loop index expression (i * 3) causes the function to calculate a large negative pointer offset, resulting in an out-of-bounds write (CWE-787) to the output buffer. This can crash the process using the library. The vulnerability affects versions prior to 3.0.18.0 and versions from 3.1.4.0-beta up to but not including 3.1.13.0. The issue is resolved in OpenImageIO versions 3.0.18.0 and 3.1.13.0.

Successful exploitation of this vulnerability can cause an out-of-bounds write leading to process crashes and potentially arbitrary code execution due to memory corruption. The CVSS score of 8.8 indicates high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported to date.

The vulnerability is fixed in OpenImageIO versions 3.0.18.0 and 3.1.13.0. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly confirmed beyond the fixed versions; therefore, verify with the vendor advisory or official release notes for the latest remediation guidance.