CVE-2026-59181: OpenImageIO Cineon File DoS Vulnerability

CVE-2026-59181 Overview

CVE-2026-59181 is a stack-based buffer overflow [CWE-121] in OpenImageIO, an open-source toolset for reading, writing, and manipulating image files used across VFX and animation pipelines. The flaw resides in the Cineon image reader at src/cineon.imageio/cineoninput.cpp. A crafted Cineon file can specify a numberOfElements value greater than the format-defined maximum of eight. The CineonInput::open() function uses this unchecked value as a loop bound while populating the fixed-size strings[8] array, writing pointers past the buffer into adjacent stack state. The result is memory corruption and denial of service. Fixed versions are 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.

Critical Impact
Opening a malicious Cineon file corrupts stack memory in the OpenImageIO process, causing crashes and potential control-flow tampering in VFX and rendering workflows.

Affected Products

OpenImageIO versions prior to 3.0.20.0
OpenImageIO versions prior to 3.1.15.0
OpenImageIO versions prior to 3.2.0.3-beta1

Discovery Timeline

2026-09-18 - CVE-2026-59181 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-59181

Vulnerability Analysis

The defect sits in the Cineon input plugin, which parses image header metadata before decoding pixels. The Cineon specification limits image elements to eight, and OpenImageIO reflects this with a fixed-size strings[8] array on the stack. CineonInput::open() reads the attacker-controlled numberOfElements field from the file header without validating it against the array bound. The loop that fills strings[] then iterates up to that attacker-supplied count, writing pointer values past the eighth slot. Adjacent stack slots, saved registers, and return addresses can be overwritten, producing memory corruption. In practice this yields a reliable denial of service through process crashes, with control-flow tampering possible depending on compiler layout and mitigations. Exploitation requires a user to open a crafted file with an application linking OpenImageIO, matching the local vector and user-interaction requirement.

Root Cause

Missing input validation on numberOfElements before it is used as the loop bound for a fixed-size stack buffer. The parser trusts a file-supplied length field instead of clamping it to the format maximum of eight.

Attack Vector

An attacker delivers a malicious .cin Cineon file to a victim who opens it in any application that uses OpenImageIO for image ingestion, including DCC tools, render farms, and asset pipelines. Parsing the header triggers the out-of-bounds write during CineonInput::open().

cpp

// Fix from src/cineon.imageio/cineoninput.cpp (PR #5250)
            m_stream = nullptr;
        }
        m_userBuf.clear();
+       m_cin.SetInStream(nullptr);
    }

    /// Helper function - retrieve string for libcineon descriptor

Source: GitHub commit 908f22f. The upstream fix hardens Cineon parsing against invalid channel counts and bit depths and cleans up stream state on failure.

Detection Methods for CVE-2026-59181

Indicators of Compromise

Unexpected crashes, segmentation faults, or stack-smashing aborts in processes that load OpenImageIO (for example oiiotool, iinfo, Nuke, Houdini, Blender addons) when handling .cin files.
Cineon files whose header numberOfElements field exceeds 8, which is outside the format specification.
Core dumps referencing CineonInput::open in the crashing frame.

Detection Strategies

Statically scan ingested .cin files and reject any with a numberOfElements value greater than 8 before they reach rendering or ingest nodes.
Build inventories of installed OpenImageIO versions across artist workstations, render farm nodes, and container images, and flag any version older than 3.0.20.0, 3.1.15.0, or 3.2.0.3-beta1.
Enable AddressSanitizer or stack canaries in test builds to catch the out-of-bounds write during regression testing of new plugin versions.

Monitoring Recommendations

Forward process-crash telemetry from workstations and render nodes into your central logging or SIEM to correlate crashes with recently opened image assets.
Monitor asset intake shares for Cineon files arriving from external or untrusted sources, which is the primary delivery path.
Track OpenImageIO package versions in software bills of materials for DCC applications and container images used in build pipelines.

How to Mitigate CVE-2026-59181

Immediate Actions Required

Upgrade OpenImageIO to 3.0.20.0, 3.1.15.0, or 3.2.0.3-beta1 or later on all systems that parse image files.
Rebuild and redeploy downstream applications and container images that statically link or bundle OpenImageIO.
Quarantine untrusted .cin files pending validation, especially those received from external vendors or contractors.

Patch Information

The fix is tracked in GitHub Pull Request #5250 and landed in commit 908f22f. Patched artifacts are published in OpenImageIO v3.0.20.0 and OpenImageIO v3.1.15.0. Full advisory context is in GHSA-xh8r-vmqq-56pp.

Workarounds

Disable the Cineon input plugin in OpenImageIO configurations where .cin support is not required.
Pre-filter incoming Cineon files with a lightweight header validator that rejects numberOfElements > 8 before OpenImageIO processes them.
Restrict opening of untrusted .cin files to sandboxed accounts or containers with no access to production assets.

bash

# Verify installed OpenImageIO version and confirm it is patched
oiiotool --version

# Example: reject Cineon files whose numberOfElements field exceeds 8
# numberOfElements is a single byte at offset 0x270 in the Cineon header
for f in *.cin; do
  n=$(xxd -s 0x270 -l 1 -p "$f")
  if [ $((16#$n)) -gt 8 ]; then
    echo "REJECT: $f (numberOfElements=$((16#$n)))"
  fi
done