CVE-2026-59156: OpenImageIO FITS Parser DoS Vulnerability

CVE-2026-59156 Overview

CVE-2026-59156 is an unbounded recursion vulnerability [CWE-674] in OpenImageIO, the toolset used across VFX and animation pipelines for reading and writing image files. The flaw resides in the FITS (Flexible Image Transport System) input plugin at src/fits.imageio/fitsinput.cpp. A crafted FITS stream containing consecutive 2880-byte header blocks without the mandatory END keyword causes FitsInput::read_fits_header() to recursively call itself without a depth bound. Repeated recursive parsing exhausts the application stack and terminates the process, resulting in denial of service. The issue is fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.

Critical Impact
Any application or service that opens untrusted FITS files with a vulnerable OpenImageIO build can be crashed remotely through a single malformed image.

Affected Products

OpenImageIO versions prior to 3.0.20.0
OpenImageIO 3.1.x versions prior to 3.1.15.0
OpenImageIO 3.2.x versions prior to 3.2.0.3-beta1

Discovery Timeline

2026-09-18 - CVE-2026-59156 published to the National Vulnerability Database
2026-09-24 - Last updated in the NVD database

Technical Details for CVE-2026-59156

Vulnerability Analysis

OpenImageIO's FITS reader parses image metadata from fixed-size 2880-byte header blocks. According to the FITS specification, the header terminates when a block containing the END keyword is encountered. The FitsInput::read_fits_header() function delegates the block-continuation logic to itself through direct recursion rather than an iterative loop.

When an attacker supplies a stream containing many consecutive 2880-byte blocks that omit the END keyword, each block triggers another recursive invocation of read_fits_header(). There is no depth check or block-count limit guarding the call. Stack frames accumulate until the process exhausts its thread stack and crashes. The vulnerability requires user interaction because a target must open the crafted file, but no authentication or elevated privileges are required.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in the FITS header-parsing routine. read_fits_header() treats a missing END keyword as an instruction to recurse into the next block instead of continuing in a bounded loop or enforcing a maximum header size.

Attack Vector

Exploitation requires an attacker to deliver a malicious FITS file to a workflow that processes it with OpenImageIO. Typical targets include render farms, asset ingestion services, thumbnail generators, and image-conversion pipelines integrated into DCC (Digital Content Creation) applications. Delivery paths include email attachments, shared storage, upload endpoints, and network-mounted asset libraries.

No synthetic exploit code is provided. Technical detail is available in the GitHub Security Advisory GHSA-xvwr-x6ch-v2fq and the fixing commit.

Detection Methods for CVE-2026-59156

Indicators of Compromise

FITS files (.fits, .fit, .fts) whose size is an exact multiple of 2880 bytes and that lack any END keyword in the first several header blocks.
Repeated process crashes of oiiotool, iinfo, maketx, or host applications embedding OpenImageIO immediately after loading a FITS asset.
Stack-overflow signals (SIGSEGV on Linux/macOS, STATUS_STACK_OVERFLOW / 0xC00000FD on Windows) originating in libOpenImageIO.

Detection Strategies

Inventory installed OpenImageIO versions across artist workstations, render nodes, and asset pipelines; flag any build older than 3.0.20.0, 3.1.15.0, or 3.2.0.3-beta1.
Add a pre-ingest validator that inspects FITS headers for a valid END keyword within a reasonable block count before handing files to OpenImageIO.
Enable crash reporting on services that call OpenImageIO and correlate stack-overflow crashes with the file most recently opened.

Monitoring Recommendations

Alert on repeated abnormal terminations of image-processing worker processes on render farms and web services.
Log all inbound FITS uploads with hash, size, and originating user for post-incident review.
Track OpenImageIO release feeds and CVE advisories to catch related parser issues in FITS and other format plugins.

How to Mitigate CVE-2026-59156

Immediate Actions Required

Upgrade OpenImageIO to 3.0.20.0, 3.1.15.0, or 3.2.0.3-beta1 or later across all endpoints, build systems, and container images.
Rebuild and redeploy any downstream applications, plugins, or Docker images that statically link or bundle a vulnerable OpenImageIO.
Restrict FITS file processing to trusted sources until patched versions are deployed everywhere in the pipeline.

Patch Information

The Academy Software Foundation resolved the issue by removing the unbounded recursion in FitsInput::read_fits_header(). Fixed releases are available as OpenImageIO v3.0.20.0 and OpenImageIO v3.1.15.0. The fix was merged through Pull Request #5248.

Workarounds

Disable or remove the FITS input plugin from OpenImageIO deployments that do not require FITS support.
Filter FITS files at ingress gateways and reject any file whose first block does not contain the END keyword.
Run image-processing workers under resource limits and automatic restart supervisors so a crash does not cascade into service outage.

bash

# Configuration example: reject FITS files missing the END keyword in the first header block
if ! head -c 2880 "$1" | grep -q 'END '; then
  echo "Rejecting $1: missing FITS END keyword in first header block"
  exit 1
fi