CVE-2024-40630

What it actually does

Bug in HeifInput::seek_subimage allows out-of-bounds or uninitialized memory reads when processing crafted HEIF files via the ImageInput API, resulting in disclosure of adjacent memory contents.

Why it matters to the business

Organizations using OpenImageIO for VFX or animation pipelines risk unintended leakage of image data, metadata, or internal memory when users or automated tools open untrusted HEIF files, potentially exposing proprietary or sensitive visual assets.

How an attack unfolds

An attacker crafts a malicious HEIF image that triggers the seek_subimage flaw; when a victim application or script loads the file through OpenImageIO's direct ImageInput interfaces, the library returns or logs unintended memory contents to the caller, disclosing information without authentication.

How to fix it

Upgrade academysoftwarefoundation/openimageio to the fixed commit fa73a2c861c1c585ff538493e3bce42cf2868512 (included in release 2.5.13.1) or later. Rebuild and redeploy all dependent applications after the upgrade; no configuration workarounds exist.

How to confirm the fix worked

Confirm the installed OpenImageIO version reports commit fa73a2c861c1c585ff538493e3bce42cf2868512 or newer; test by loading representative HEIF files through ImageInput::seek_subimage and verify no unexpected data appears in results or logs.

Typical attack path

1. Attacker prepares a specially malformed HEIF file targeting the seek_subimage path
2. Victim opens or processes the file using an application that calls OpenImageIO ImageInput APIs directly
3. seek_subimage executes the flawed code path and returns or exposes adjacent memory
4. Attacker observes or captures the leaked information from application output, logs, or error handling

How to detect it

Review application logs and error output for unexpected data patterns or memory artifacts following HEIF file loads; inspect process memory dumps or strace output around ImageInput calls for signs of out-of-bounds reads; correlate with file-open events on untrusted HEIF content.

What your security team should do

• Immediately upgrade all OpenImageIO installations to the fixed commit or 2.5.13.1 release
• Audit and replace any custom code that directly invokes ImageInput APIs on untrusted HEIF input
• Add HEIF file-type restrictions or sandboxing for image-processing workflows until upgrades complete
• Monitor upstream releases for any follow-on fixes given the 820-day publication age and stable EPSS