USN-8438-1: openimageio Ubuntu
Vulnerability summary
USN-8438-1 is a vulnerability in openimageio Ubuntu with no CVSS score yet.
Advisory lineage
Upstream 6 · Downstream 0Timeline
- 16-06-2026PublishedVulnerability first disclosed.
- 17-06-2026Last modifiedVulnerability information updated.
Description
openimageio vulnerabilities It was discovered that OpenImageIO incorrectly performed bounds checking when processing SGI files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-43903) It was discovered that OpenImageIO incorrectly handled run-length encoding when processing Softimage PIC files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-43904) It was discovered that OpenImageIO incorrectly validated subimage metadata when processing HEIF files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-43906) It was discovered that OpenImageIO contained multiple integer overflow vulnerabilities when processing DPX files. An attacker could possibly use these issues to cause a denial of service or execute arbitrary code. (CVE-2026-43907, CVE-2026-43908, CVE-2026-43909)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- openimageio< 1.6.11~dfsg0-1ubuntu1+esm2 | < 1.7.17~dfsg0-1ubuntu2+esm1 | < 2.1.12.0~dfsg0-1ubuntu0.1~esm1 | < 2.4.17.0+dfsg-1.1ubuntu0.1~esm1 | < 2.5.19.1+dfsg-2ubuntu0.1~esm1
1 vendor · 1 product