CVE-2024-55194 Memory corruption in n/a
A heap overflow in OpenImageIO allows attackers to execute arbitrary code or cause denial of service via crafted image files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-55194?
CVE-2024-55194 is a critical memory corruption vulnerability in Openimageio Openimageio, published on 23 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h.
Which versions are affected by CVE-2024-55194?
It affects 1 product.
Linux distribution packages (1)
OpenImageIO openSUSE:Tumbleweed | All versions | 3.1.14.0-1.1 |
Products include Openimageio Openimageio.
How do I fix CVE-2024-55194?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-55194 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-55194 exists.
Other vulnerabilities in Openimageio Openimageio
- CVE-2024-55192 Memory corruption in n/a
- CVE-2023-42299 Memory corruption in n/a
- CVE-2022-38143 Memory corruption in OpenImageIO
- CVE-2026-43908 OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder
- CVE-2026-43909 OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder
Sources
Also known as DEBIAN-CVE-2024-55194, GHSA-cf7w-246v-3mp8, UBUNTU-CVE-2024-55194, openSUSE-SU-2026:10918-1.