CVE-2024-40630
HEIF Heap OOB Read in OpenImageIO
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in HeifInput::seek_subimage(). In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the ImageInput APIs. This bug has been addressed in commit 0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
HEIF Heap OOB Read in OpenImageIO
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in HeifInput::seek_subimage(). In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the ImageInput APIs. This bug has been addressed in commit 0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2024-40630- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2024-38550
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in HeifInput::seek_subimage(). In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the ImageInput APIs. This bug has been addressed in commit 0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
EUVD-2024-38550- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
NVD
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in HeifInput::seek_subimage(). In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the ImageInput APIs. This bug has been addressed in commit 0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2024-40630- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
HEIF Heap OOB Read in OpenImageIO
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in HeifInput::seek_subimage(). In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the ImageInput APIs. This bug has been addressed in commit 0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2024-40630- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-40630
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in HeifInput::seek_subimage(). In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the ImageInput APIs. This bug has been addressed in commit 0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
DEBIAN-CVE-2024-40630- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-40630
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in HeifInput::seek_subimage(). In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the ImageInput APIs. This bug has been addressed in commit 0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
UBUNTU-CVE-2024-40630- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14200-1 No score
OpenImageIO-2.5.13.1-1.1 on GA media
These are all security issues fixed in the OpenImageIO-2.5.13.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14200-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openimageioDebian:12 |
All versions, plus listed versions 2.4.12.0+dfsg-12.4.13.0+dfsg-12.4.14.0+dfsg-12.4.16.0+dfsg-12.4.17.0+dfsg-1 Show 18 moreShow less2.4.17.0+dfsg-1.12.4.7.1+dfsg-22.4.9.0+dfsg-12.5.10.1+dfsg-12.5.12.0+dfsg-12.5.12.0+dfsg-22.5.14.0+dfsg-12.5.15.0+dfsg-12.5.16.0+dfsg-12.5.18.0+dfsg-12.5.19.1+dfsg-12.5.19.1+dfsg-22.5.7.0+dfsg-13.1.18.0+dfsg-13.1.18.0+dfsg-23.1.18.1+dfsg-13.1.18.1+dfsg-23.2.1.3+dfsg-1 |
None known |
openimageioDebian:13 |
before 2.5.14.0+dfsg-1 | 2.5.14.0+dfsg-1 |
openimageioDebian:14 |
before 2.5.14.0+dfsg-1 | 2.5.14.0+dfsg-1 |
openimageioUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.5.17~dfsg0-1ubuntu21.5.20~dfsg0-1ubuntu21.5.23~dfsg0-1ubuntu11.6.9~dfsg0-4ubuntu11.6.10~dfsg0-1ubuntu11.6.10~dfsg0-2ubuntu11.6.11~dfsg0-1ubuntu11.6.11~dfsg0-1ubuntu1+esm2 |
None known |
openimageioUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.6.17~dfsg0-1ubuntu51.7.17~dfsg0-1ubuntu21.7.17~dfsg0-1ubuntu2+esm1 |
None known |
openimageioUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.10~dfsg0-12.0.11~dfsg0-12.0.12~dfsg0-12.0.12~dfsg0-1build12.0.12~dfsg0-1build2 Show 4 moreShow less2.1.10.1~dfsg0-5ubuntu42.1.10.1~dfsg0-5ubuntu52.1.12.0~dfsg0-12.1.12.0~dfsg0-1ubuntu0.1~esm1 |
None known |
openimageioUbuntu:22.04:LTS |
All versions, plus listed versions 2.2.10.1+dfsg-1build12.2.18.0+dfsg-12.2.18.0+dfsg-1build22.2.18.0+dfsg-1ubuntu2 |
None known |
openimageioUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.4.14.0+dfsg-12.4.16.0+dfsg-12.4.16.0+dfsg-1build12.4.17.0+dfsg-12.4.17.0+dfsg-1build12.4.17.0+dfsg-1.1build32.4.17.0+dfsg-1.1build42.4.17.0+dfsg-1.1ubuntu0.1~esm1 |
None known |
openimageioUbuntu:25.10 |
All versions, plus listed versions 2.5.18.0+dfsg-1build12.5.18.0+dfsg-1build2 |
None known |
openimageioUbuntu:26.10 |
All versions, plus listed versions 2.5.19.1+dfsg-22.5.19.1+dfsg-2build12.5.19.1+dfsg-2build2 |
None known |
openimageioUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 2.5.18.0+dfsg-1build22.5.19.1+dfsg-1build12.5.19.1+dfsg-1build32.5.19.1+dfsg-1build52.5.19.1+dfsg-22.5.19.1+dfsg-2ubuntu0.1~esm1 |
None known |
OpenImageIOopenSUSE:Tumbleweed |
before 2.5.13.1-1.1 | 2.5.13.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-40630 is a medium vulnerability (CVSS 4.3) in Academysoftwarefoundation Openimageio, published July 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in openimageio 2.5.14.0+dfsg-1.
References
github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-jjm9-9m4m-c8p2
nvd.nist.gov/vuln/detail/CVE-2024-40630
security-tracker.debian.org/tracker/CVE-2024-40630
ubuntu.com/security/CVE-2024-40630
cve.org/CVERecord?id=CVE-2024-40630
suse.com/security/cve/CVE-2024-40630