This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-42450 →

DEBIAN-CVE-2026-42450

OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, `FileFormatSpi3D.cpp:163` uses `sscanf` with `%s...

Original description

The description as published by the source.

OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, FileFormatSpi3D.cpp:163 uses sscanf with %s into 64-byte stack buffers when parsing LUT data lines. Input comes from lineBuffer[4096], so a crafted .spi3d file can overflow by ~4000 bytes on non-Windows. Version 2.5.2 fixes the issue.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 opencolorio

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 opencolorio

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 opencolorio

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org