CVE-2026-7582 Overview
CVE-2026-7582 is an out-of-bounds write vulnerability in AcademySoftwareFoundation OpenImageIO versions up to 3.2.0.1-dev. The flaw resides in the DDS Image Handler component, specifically in src/dds.imageio/ddsinput.cpp. An attacker with local access and low privileges can trigger the memory corruption by supplying a crafted DDS image file. The issue is tracked under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). A public proof-of-concept exists, and the maintainers have committed a fix identified by patch hash 94ec2deec3e3bf2f2e2ff84d008e27425d626fe2.
Critical Impact
Local processing of a malicious DDS image can cause out-of-bounds memory writes in OpenImageIO, potentially leading to memory corruption and limited integrity, confidentiality, and availability impact.
Affected Products
- AcademySoftwareFoundation OpenImageIO up to version 3.2.0.1-dev
- OpenImageIO DDS Image Handler component (src/dds.imageio/ddsinput.cpp)
- Downstream applications and pipelines that link OpenImageIO for DDS decoding
Discovery Timeline
- 2026-05-01 - CVE-2026-7582 published to NVD
- 2026-05-01 - Last updated in NVD database
Technical Details for CVE-2026-7582
Vulnerability Analysis
The vulnerability lives in OpenImageIO's DDS (DirectDraw Surface) image input plugin. When the parser processes attacker-controlled fields from a malformed DDS file, it writes data past the bounds of an allocated buffer. This produces a classic out-of-bounds write condition mapped to [CWE-119]. The exploit requires local file access, meaning an attacker must convince the victim or an automated pipeline to load the crafted DDS file.
A public proof-of-concept is available in the GitHub PoC Repository, which demonstrates the crash condition during DDS image read operations. The EPSS probability remains low, indicating limited likelihood of widespread exploitation activity.
Root Cause
The root cause is insufficient bounds checking in the DDS image reader implemented in ddsinput.cpp. The parser trusts size or offset fields embedded in the DDS file header without validating them against the actual buffer capacity. When these values exceed expected ranges, the subsequent write operation overruns the destination buffer. The upstream fix in commit 94ec2de and Pull Request #5131 tightens these validation checks before memory writes occur.
Attack Vector
The attack vector is local. An attacker plants or supplies a malicious DDS file, then waits for OpenImageIO or an application using the library to decode it. Common scenarios include visual effects pipelines, asset ingestion services, and game asset converters that process untrusted DDS content. Successful exploitation may corrupt heap or stack memory adjacent to the target buffer.
No verified code examples are available. See the GitHub Commit 94ec2de for the patch diff and the VulDB #360529 entry for additional technical context.
Detection Methods for CVE-2026-7582
Indicators of Compromise
- Unexpected crashes or segmentation faults in processes that link OpenImageIO when loading DDS files
- DDS files originating from untrusted sources placed in asset ingestion or render pipeline directories
- Anomalous memory access violations logged by host-based monitoring during image decoding
Detection Strategies
- Monitor application crash telemetry for OpenImageIO-linked binaries processing DDS inputs
- Inspect DDS file headers for malformed or out-of-range size and offset fields prior to ingestion
- Track installations of OpenImageIO at or below version 3.2.0.1-dev across build and render hosts
Monitoring Recommendations
- Enable memory error detection (AddressSanitizer or equivalent) in non-production builds that consume DDS assets
- Log and alert on process exits with abnormal termination codes from image-processing services
- Audit software bills of materials (SBOMs) to identify dependencies that bundle OpenImageIO
How to Mitigate CVE-2026-7582
Immediate Actions Required
- Upgrade OpenImageIO to a release that includes commit 94ec2deec3e3bf2f2e2ff84d008e27425d626fe2
- Restrict processing of DDS files to trusted sources until the patch is deployed
- Run image decoding workflows under least-privilege accounts to limit blast radius
Patch Information
The upstream maintainers committed a fix in GitHub Commit 94ec2de, merged via Pull Request #5131. Rebuild OpenImageIO from a source tree that includes this commit, or wait for a packaged release that incorporates it. Verify the patched binary is deployed across all systems performing DDS decoding, including build agents and render farm nodes.
Workarounds
- Disable or remove the DDS input plugin from OpenImageIO builds where DDS support is not required
- Validate and sanitize DDS files with an independent parser before passing them to OpenImageIO
- Sandbox image decoding workloads using container or process isolation to contain memory corruption
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
