CVE-2024-55194 is a critical severity (CVSS 9.8) heap buffer overflow in OpenImageIO 3.1.0.0dev, in the fmath.h header. A fuzzing report found it while running oiiotool. The project closed the issue on 10 December 2024 with a fix for broken PGM files.
What's affected
The record names OpenImageIO v3.1.0.0dev, a development version. The affected component is fmath.h, at the line the report names.
Project issue 4552 was opened on 2 December 2024. It was closed as completed through pull request 4559 and commit 34b29f3 on 10 December 2024, and the linked change is titled as a fix for a broken PGM file causing a memory access error. The issue does not name a release, so check the release notes for the first release with that commit.
Only build and bundle versions that include the commit are safe to treat as fixed.
How to check if you're exposed
Locate every copy of the library and compare it to the fix.
oiiotool --version
pip show openimageio 2>/dev/null
Check whether the build date or release is later than the fix on 10 December 2024 and whether the release notes mention it. Then review which of your services open PGM or other image files that come from users, because that is the exposure path.
What to do now
- Inventory all OpenImageIO copies, including those inside container images.
- Update to a release that includes pull request 4559.
- Rebuild container images that bundle the library.
- Reject unexpected image formats at upload.
- Run conversion in a sandbox with memory and CPU limits.
Why it matters
The record lists CWE-120 (Classic Buffer Overflow) and CWE-787 (Out-of-bounds Write). A heap overflow writes data past the end of an allocated buffer. The report ties it to a malformed image file, and the fix title speaks of a broken PGM file. Image parsers must check dimensions and sizes in the header against the data that follows, and when they trust the header, the result is a memory error.
The 9.8 score is the generic library vector. This is one of three OpenImageIO issues reported by the same fuzzing team on the same day, so patch them together by updating once to a release that includes all of the fixes. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-55194.
Quick check
Which commit closed the issue?
The issue shows it closed as completed through pull request 4559 and commit 34b29f3 on 10 December 2024.
Are the other OpenImageIO CVEs related?
CVE-2024-55192 and CVE-2024-55193 came from the same fuzzing report series, so update once for all three.
Sources
Last reviewed: 19 October 2026.
