CVE-2026-42450
2026-06-24
14h17 +00:00
14h17 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, `FileFormatSpi3D.cpp:163` uses `sscanf` with `%s` into 64-byte stack buffers when parsing LUT data lines. Input comes from `lineBuffer[4096]`, so a crafted .spi3d file can overflow by ~4000 bytes on non-Windows. Version 2.5.2 fixes the issue.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Buffer Copy without Checking Size of Input The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
