Back to overview

CVE-2026-42450

HIGH
8.4
CVSS 4.0
Description
OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, `FileFormatSpi3D.cpp:163` uses `sscanf` with `%s` into 64-byte stack buffers when parsing LUT data lines. Input comes from `lineBuffer[4096]`, so a crafted .spi3d file can overflow by ~4000 bytes on non-Windows. Version 2.5.2 fixes the issue.

Metadata

CVE ID
CVE-2026-42450
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-04-27 13:55 UTC
Published
2026-06-24 13:20 UTC
Last updated
2026-06-24 13:20 UTC
Primary CWE
CWE-120
CWE-120: Buffer Copy without Checking Size of Input ('Classi…
Vendor / Product
AcademySoftwareFoundation / OpenColorIO
Sources
cve.org  ·  NVD

Severity & Metrics

8.4 HIGH CVSS 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products (1)
VendorProductPlatformVersions
AcademySoftwareFoundation OpenColorIO — < 2.5.2
Weakness (CWE)
CWESourceDescription
CWE-120 cna CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.4 HIGH 4.0 cna CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (2)
Back to overview