CVE-2024-55193 is a critical severity (CVSS 9.8) segmentation violation in OpenImageIO 3.1.0.0dev, in the string_view.h header. A fuzzing report found it while running iconvert. The project closed the issue on 5 December 2024, with the fix in pull request 4557.
What's affected
The record names OpenImageIO v3.1.0.0dev, a development version. The component is src/include/OpenImageIO/string_view.h.
Project issue 4551 was opened on 2 December 2024. A maintainer replied the same day that a fix would follow shortly, proposed it in pull request 4557, and the issue was closed as completed on 5 December 2024. The issue does not name a release, so check the release notes for the first release that carries the change.
If you use OpenImageIO from a distribution or a vendor bundle, confirm that your build includes the fix.
How to check if you're exposed
Find where OpenImageIO sits in your software.
oiiotool --version
pip show openimageio 2>/dev/null
Compare the version and build date with the fix in pull request 4557. Then identify which of your services process image files from outside, since a crash in an image tool matters most when untrusted files reach it, for example on upload or in a conversion queue.
What to do now
- Find all copies of OpenImageIO, including those bundled in other tools.
- Update to a release that includes the fix from pull request 4557.
- Run image conversion jobs in a separate, restartable process so that a crash does not take down the service.
- Limit the size and type of image files accepted from outside.
- Watch for repeated crashes in image workers, since they can be a sign of someone testing inputs.
Why it matters
The weakness is CWE-476 (NULL Pointer Dereference). The program uses a pointer that holds no valid address, and the operating system stops it with a segmentation fault. In most cases this ends in a crash and denial of service, rather than code execution, though the effect depends on the surrounding code.
The 9.8 score uses a generic vector for library bugs. A crash bug in a command line image tool is less severe in practice than the number suggests, unless your service takes untrusted images and has no isolation. Reachability checks answer that question for your own code. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-55193.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-55193 fixed?
The project closed issue 4551 as completed on 5 December 2024, with the fix proposed in pull request 4557.
Why is a crash rated critical?
The score comes from the generic library vector. Your real risk depends on whether untrusted images reach the code.
Sources
Last reviewed: 19 October 2026.
