CVE-2025-15506: OpenColorIO Out-of-Bounds Read Vulnerability
Summary
CVE-2025-15506: AcademySoftwareFoundation OpenColorIO has an out-of-bounds vulnerability. Affects opencolorio versions < 2.5.1. Fixed in 2.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenColorIO is an open-source color management system designed for visual effects and animation. It provides a framework for managing color transformations and is widely used in the film and visual effects industries. The package allows users to define color spaces and perform conversions between them, ensuring consistent color representation across different platforms. However, versions up to 2.5.0 are vulnerable to an out-of-bounds read issue, which can lead to potential data exposure.
Vulnerability Detail
A vulnerability was identified in OpenColorIO versions up to 2.5.0, specifically in the ConvertToRegularExpression function located in src/OpenColorIO/FileRules.cpp. This flaw allows for an out-of-bounds read, which can be exploited locally by an attacker. The ramifications of this vulnerability include the potential exposure of sensitive data or application crashes. The exploit has been made public, increasing the urgency for users to address this issue.
How To Fix
Latest published version: 2.6.0 as of 23 Oct 2026
pip install --upgrade "opencolorio==2.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.1
This is the first release that contains the fix.
pip install --upgrade "opencolorio==2.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch by updating to the latest version.
Conclusion
The out-of-bounds read vulnerability in OpenColorIO poses a risk to users of versions up to 2.5.0. It is essential to update to version 2.5.1 or later to ensure the security of your application. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for opencolorio →
FAQ
The vulnerability is an out-of-bounds read issue that can lead to data exposure or application crashes.
OpenColorIO versions up to 2.5.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible to mitigate risks.
The CVSS score of this vulnerability is 3.3, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencolorio.
