CVE-2024-40630

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in `HeifInput::seek_subimage()`. In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the `ImageInput` APIs. This bug has been addressed in commit `0a2dcb4c` which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-125

• https://github.com/AcademySoftwareFoundation/OpenImageIO/blob/7c486a1121a4bf71d50ff555fab2770294b748d7/src/heif.imageio/heifinput.cpp#L250
• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/0a2dcb4cf2c3fd4825a146cd3ad929d9d8305ce3
• https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-jjm9-9m4m-c8p2
• https://github.com/AcademySoftwareFoundation/OpenImageIO/blob/7c486a1121a4bf71d50ff555fab2770294b748d7/src/heif.imageio/heifinput.cpp#L250
• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/0a2dcb4cf2c3fd4825a146cd3ad929d9d8305ce3
• https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-jjm9-9m4m-c8p2

Published

Jul 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-40625GeoServer is an open source server that allows users to shar…4.9
• CVE-2024-40626Outline is an open source, collaborative document editor. A …5.4
• CVE-2024-40627Fastapi OPA is an opensource fastapi middleware which includ…5.8
• CVE-2024-40628JumpServer is an open-source Privileged Access Management (P…9.1
• CVE-2024-40629JumpServer is an open-source Privileged Access Management (P…9.8
• CVE-2024-4063A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build…3.7
• CVE-2024-40631Plate media is an open source, rich-text editor for React. E…8.1
• CVE-2024-40632Linkerd is an open source, ultralight, security-first servic…3.7
• CVE-2024-40633Sylius is an Open Source eCommerce Framework on Symfony. A s…5.3
• CVE-2024-40634Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2024-40635containerd is an open-source container runtime. A bug was fo…7.8
• CVE-2024-40636Steeltoe is an open source project that provides a collectio…5.3