{
  "cveId": "CVE-2024-40630",
  "url": "https://patchblox.com/security/cve/CVE-2024-40630",
  "summary": "CVE-2024-40630 is fixed in openimageio on 1 platform, first by DEBIAN-CVE-2024-40630, released July 15, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "openimageio: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX...",
  "description": "OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in \u0060HeifInput::seek_subimage()\u0060.  In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the \u0060ImageInput\u0060 APIs. This bug has been addressed in commit \u00600a2dcb4c\u0060 which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.",
  "published": "2024-07-15T20:15:05Z",
  "severity": "medium",
  "cvss": 4.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
  "epss": 0.00448,
  "epssPercentile": 0.39208,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "openimageio",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.5.14.0\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-40630",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-40630",
      "released": "2024-07-15T20:15:05Z"
    },
    {
      "platform": "linux",
      "product": "openimageio",
      "release": "Debian 14",
      "fixedVersion": "2.5.14.0\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-40630",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-40630",
      "released": "2024-07-15T20:15:05Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}