CVE-2026-50291

Executive Summary

CVE-2026-50291 is an out-of-bounds read (CWE-125) in OpenImageIO, a widely used image I/O library for VFX and animation pipelines. Processing a crafted BMP file with an empty color table and RLE compression through oiiotool or any linked application triggers an invalid palette read in BmpInput::read_native_scanline, crashing the process and causing a denial of service. The vulnerability is locally exploitable with user interaction, rated CVSS 5.5, and affects versions prior to 3.0.16.0 and 3.1.11.0.

Technical Analysis

The flaw resides in OpenImageIO's BMP input handler, specifically within src/bmp.imageio/bmpinput.cpp. The BMP file format supports a palette (color table) used by indexed-color and RLE-compressed images. In the affected versions, when decoding an RLE-compressed scanline, BmpInput::read_native_scanline performs a palette lookup without first validating that the color table is non-empty. A crafted BMP that declares RLE compression but carries an empty (zero-entry) palette causes the code to read from an empty palette buffer — an out-of-bounds read classified as CWE-125.

The attack surface is the BMP parsing path reachable through the public OpenImageIO API and the oiiotool command-line utility. The defect is triggered during scanline decoding (the read_native_scanline routine), meaning the malformed image must be opened and read, not merely inspected for metadata. Because the read occurs against an empty palette, the memory access is invalid, producing a process crash.

Per the NVD description, this is a denial-of-service condition only: the impact is availability (A:H) with no confidentiality or integrity impact (C:N/I:N/A:H). No code execution or information disclosure is described. CVSS 3.1 rates it 5.5 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — locally exploitable, low complexity, no privileges required, requiring user interaction, unchanged scope, high availability impact. The EPSS score has not been published by FIRST.org; no EPSS value should be assumed. CWE is CWE-125 (Out-of-bounds Read).

At the time of writing, patch confidence is 0/4 — no patch evidence is available from tracked sources. The upstream advisory states the issue is addressed in 3.0.16.0 and 3.1.11.0, so operators should treat current deployments as unpatched until those versions are confirmed in place. No public PoC, exploit code, or Nuclei template exists in the provided data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (out-of-bounds read via malicious image parsing). Only function names, file paths, and behaviors named in the NVD description are used.

1. Reconnaissance / target identification. An attacker identifies a target environment that ingests untrusted BMP files through OpenImageIO — for example a VFX render farm, an asset-transcoding pipeline, or any service invoking oiiotool or an application linked to OpenImageIO on attacker-supplied images.

2. Triggering the flaw class. The attacker crafts a BMP file that uses RLE compression and declares an empty color table. Delivery is via any channel that causes the victim (or an automated pipeline) to process the file: uploaded asset, shared project folder, email attachment, or a job queued to a batch renderer. Because the interface is local (AV:L) and requires user interaction (UI:R), the attacker must get the file processed by the victim's installation.

3. Execution at the vulnerability-class level. When the image is read, OpenImageIO reaches BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. During decoding of the RLE-compressed scanline, BmpInput::read_native_scanline performs an invalid palette read. No attacker-controlled write, hook, or command execution is described — the primitive is an out-of-bounds read that faults the process.

4. Post-exploitation impact. The observable outcome is a process crash — denial of service. In a pipeline context, a single poisoned asset can kill a render/transcode worker, stalling or failing batch jobs. No lateral movement, credential theft, or persistence is described by the vulnerability data.

Impact Assessment

Business impact centers on availability. A process crash in oiiotool or a linked application can interrupt rendering, transcoding, or automated asset-processing jobs. In a shared VFX/animation pipeline, a crafted asset introduced once may be re-processed by many workers, amplifying the disruption. Blast radius is bounded to systems that open the malicious BMP; there is no described cross-system propagation.

CVSS 3.1 breakdown: AV:L (local delivery required), AC:L (low attack complexity), PR:N (no privileges needed), UI:R (victim must process the file), S:U (impact confined to the vulnerable component), C:N (no confidentiality loss), I:N (no integrity loss), A:H (high availability impact) → 5.5 Medium. CISA KEV status is NO, and there is no evidence of in-the-wild exploitation in the provided data.

Detection Guidance

Sigma Rule

title: OpenImageIO BMP Empty Palette Out-of-Bounds Read Crash (CVE-2026-50291)
id: 8f2c1a44-9b7e-4d21-a3c5-0e6f7a91b2d3
status: experimental
description: Detects crashes of oiiotool or OpenImageIO-linked processes consistent with an empty-palette RLE BMP out-of-bounds read.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-50291
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/oiiotool'
      - '\\oiiotool.exe'
  selection_bmp:
    CommandLine|contains: '.bmp'
  condition: selection_img and selection_bmp
fields:
  - CommandLine
  - Image
  - ParentImage
falsepositives:
  - Legitimate batch processing of BMP assets
level: low
tags:
  - attack.t1203
  - cve.2026.50291

YARA Rule

rule CVE_2026_50291_BMP_EmptyPalette_RLE
{
    meta:
        description = "Detects BMP files using RLE compression with an empty/zero-size color table that may trigger CVE-2026-50291 in OpenImageIO"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-50291"
        date = "2026-01-01"
        cve = "CVE-2026-50291"

    strings:
        $bmp_magic = { 42 4D }

    condition:
        $bmp_magic at 0 and
        // BITMAPINFOHEADER: biCompression at offset 30 (RLE8=1 or RLE4=2) and biClrUsed at offset 46 == 0
        uint16(0) == 0x4D42 and
        (uint32(30) == 1 or uint32(30) == 2) and
        uint32(46) == 0 and
        filesize < 10MB
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-50291 OpenImageIO BMP Empty Color Table RLE File Transfer"; flow:established,to_server; file_data; content:"|42 4D|"; offset:0; depth:2; byte_test:4,=,1,30,relative; byte_test:4,=,0,16,relative; reference:cve,2026-50291; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-50291; classtype:attempted-dos; sid:202650291; rev:1;)

Elastic Detection

process where process.name in ("oiiotool", "oiiotool.exe") and process.command_line : "*.bmp*"

Splunk SPL Query

index=main (sourcetype=linux_audit OR sourcetype=sysmon OR sourcetype=WinEventLog:Security)
(process_name="oiiotool" OR process_name="oiiotool.exe")
(command_line="*.bmp*")
| stats count by host, user, process_name, process, command_line, parent_process_name
| sort - count

Wazuh OSSEC Rule

<group name="openimageio,cve-2026-50291,">
  <rule id="100291" level="10">
    <if_sid>5920</if_sid>
    <field name="command">oiiotool</field>
    <match>\.bmp</match>
    <description>CVE-2026-50291: OpenImageIO oiiotool processing a BMP file - potential empty-palette RLE out-of-bounds read crash.</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve_2026_50291,availability_impact,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED — no patch evidence is available from any tracked source.

1. Immediate mitigations: Do not process untrusted BMP files through oiiotool or OpenImageIO-linked applications. Restrict BMP ingestion to trusted sources; quarantine and validate incoming image assets before they reach render/transcode pipelines. Run oiiotool and image-processing jobs with least privilege and under process supervision (systemd restart policies, container restart) so a crash does not stall an entire pipeline. Where feasible, disable BMP handling if it is not required.

2. Patch / upgrade steps: Upgrade to OpenImageIO 3.0.16.0 or 3.1.11.0, the versions in which the issue is stated to be fixed. Verify the installed version with oiiotool --version and confirm all linked applications and OCI images use the patched library. Rebuild any statically linked binaries against the fixed version.

3. Long-term hardening: Add image parser fuzzing (e.g., libFuzzer/AFL against the BMP input path) to CI. Enforce strict validation of palette/color-table presence before scanline decode in downstream code you control. Track OpenImageIO security advisories and maintain a rapid-patch workflow for media-processing dependencies. Because patch confidence is currently 0/4, re-validate the availability of the fixed versions with the upstream project before relying solely on the version numbers cited.

References

• NVD — CVE-2026-50291: https://nvd.nist.gov/vuln/detail/CVE-2026-50291
• OpenImageIO Release Notes (versions 3.0.16.0 / 3.1.11.0): https://github.com/AcademySoftwareFoundation/OpenImageIO/releases
• OpenImageIO Project / Documentation: https://openimageio.readthedocs.io/
• CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild: No evidence of exploitation in the wild is present in the provided data. CISA KEV status is NO, EPSS is unscored, no public PoC or exploit code is available, and no Nuclei template exists.