CVE-2024-55192 is a critical severity (CVSS 9.8) heap buffer overflow in OpenImageIO 3.1.0.0dev, in the farmhash Fetch64 function. A fuzzing report found it with the iconvert and oiiotool tools. The project closed the issue on 4 January 2025, saying it was fixed by pull request 4565.
What's affected
The record names OpenImageIO v3.1.0.0dev, which is a development version, not a tagged release. The affected component is the farmhash header, in the Fetch64 function.
The project issue, number 4550, was opened on 2 December 2024 by a fuzzing team. On 4 January 2025 a maintainer commented that it was fixed by pull request 4565 and closed it. The issue does not state a release number, so check the project release notes for the first release that includes the change.
If you use a release build of OpenImageIO from a package manager, check whether your build includes that fix.
How to check if you're exposed
Find out how OpenImageIO reaches your systems. It is a C++ library used by image tools and some applications, and may come from the operating system, a vendor bundle, or a Python wheel.
oiiotool --version
pip show openimageio 2>/dev/null
Compare the version to the project release notes, and check whether it includes pull request 4565. Also list which of your services pass untrusted images to OpenImageIO, because that is the path to the flaw.
What to do now
- Find all builds and bundles of OpenImageIO in your environment.
- Update to a release that includes the fix from pull request 4565, after checking the project release notes.
- Rebuild applications that link the library statically.
- Do not feed untrusted image files to tools that use an affected build.
- Run image processing in a sandboxed process with limited rights.
Why it matters
The record lists CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). A heap overflow writes beyond a buffer allocated on the heap, corrupting neighbouring data. Fuzzers are good at finding these, because they try huge numbers of malformed inputs against the file parsers and hashing functions.
The 9.8 score comes from the generic vector that the NVD uses for memory bugs in libraries: network reach, no login, high impact. Real exposure depends on whether your software passes untrusted input into the library. That question is exactly where reachability analysis helps, because it separates code that really calls a vulnerable function from code that only ships the library. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-55192.
Quick check
Has the project fixed CVE-2024-55192?
The issue was closed on 4 January 2025 with the note that pull request 4565 fixed it.
Is this a stable release?
The record names 3.1.0.0dev, a development version. Check which release first includes the fix.
Sources
Last reviewed: 19 October 2026.
