[From nobody Wed Oct  7 01:03:10 2026
Received: (at submit) by bugs.debian.org; 13 Jun 2026 11:33:47 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.8 required=4.0 tests=BAYES_00, FOURLA,
 FROMDEVELOPER, 
 MDO_DATING14,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 88; hammy, 150; neutral, 198; spammy,
 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil,
 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian,
 0.000-+--H*Ad:N*Bug
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1wYMcU-006Jx4-3D
 for submit@bugs.debian.org; Sat, 13 Jun 2026 11:33:47 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: openimageio: CVE-2026-43903 CVE-2026-43904 CVE-2026-43905
 CVE-2026-43906 CVE-2026-43907 CVE-2026-43908 CVE-2026-43909 CVE-2026-43996
Message-ID: <178135042603.66672.5578932174828588573.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0
Date: Sat, 13 Jun 2026 13:33:46 +0200
Delivered-To: submit@bugs.debian.org

U291cmNlOiBvcGVuaW1hZ2VpbwpWZXJzaW9uOiAyLjUuMTkuMStkZnNnLTIKU2V2ZXJpdHk6IGlt
cG9ydGFudApUYWdzOiBzZWN1cml0eSB1cHN0cmVhbQpYLURlYmJ1Z3MtQ2M6IGNhcm5pbEBkZWJp
YW4ub3JnLCBEZWJpYW4gU2VjdXJpdHkgVGVhbSA8dGVhbUBzZWN1cml0eS5kZWJpYW4ub3JnPgoK
SGksCgpUaGUgZm9sbG93aW5nIHZ1bG5lcmFiaWxpdGllcyB3ZXJlIHB1Ymxpc2hlZCBmb3Igb3Bl
bmltYWdlaW8uCgpUaGlzIGlzICBhIHN1YnN0YW50aWFsIGJhdGNoIG9mIENWRXMsIHBsZWFzZSBo
ZWxwIHRvIHByb3Blcmx5IGFzc2Vzcwp0aGVtLgoKQ1ZFLTIwMjYtNDM5MDNbMF06CnwgT3Blbklt
YWdlSU8gaXMgYSB0b29sc2V0IGZvciByZWFkaW5nLCB3cml0aW5nLCBhbmQgbWFuaXB1bGF0aW5n
CnwgaW1hZ2UgZmlsZXMgb2YgYW55IGltYWdlIGZpbGUgZm9ybWF0IHJlbGV2YW50IHRvIFZGWCAv
IGFuaW1hdGlvbi4KfCBQcmlvciB0byAzLjAuMTguMCBhbmQgMy4xLjEzLjAsIHNnaWlucHV0LmNw
cDoyNjUsMjc0IHVzZQp8IE9JSU9fREFTU0VSVCBmb3IgYm91bmRzIGNoZWNraW5nIGluIHRoZSBS
TEUgZGVjb2RlIGxvb3AuIEluIHJlbGVhc2UKfCBidWlsZHMsIE9JSU9fREFTU0VSVCBjb21waWxl
cyB0byAoKHZvaWQpc2l6ZW9mKHgpKSAoZGFzc2VydC5oOjIxMCksCnwgbWFraW5nIGFsbCBib3Vu
ZHMgY2hlY2tzIG5vLW9wcy4gQSBjcmFmdGVkIC5zZ2kgZmlsZSB3aXRoIFJMRSBjb3VudAp8IGV4
Y2VlZGluZyBzY2FubGluZSB3aWR0aCBjYXVzZXMgaGVhcCBidWZmZXIgb3ZlcmZsb3cgYW5kIGNy
YXNoLiBUaGlzCnwgdnVsbmVyYWJpbGl0eSBpcyBmaXhlZCBpbiAzLjAuMTguMCBhbmQgMy4xLjEz
LjAuCgoKQ1ZFLTIwMjYtNDM5MDRbMV06CnwgT3BlbkltYWdlSU8gaXMgYSB0b29sc2V0IGZvciBy
ZWFkaW5nLCB3cml0aW5nLCBhbmQgbWFuaXB1bGF0aW5nCnwgaW1hZ2UgZmlsZXMgb2YgYW55IGlt
YWdlIGZpbGUgZm9ybWF0IHJlbGV2YW50IHRvIFZGWCAvIGFuaW1hdGlvbi4KfCBQcmlvciB0byAz
LjAuMTguMCBhbmQgMy4xLjEzLjAsIHNvZnRpbWFnZWlucHV0LmNwcDo0NjkgKG1peGVkIFJMRSkK
fCBhbmQgOjM0NSAocHVyZSBSTEUpIGRvIG5vdCBjbGFtcCB0aGUgcnVuIGxlbmd0aCB0byByZW1h
aW5pbmcKfCBzY2FubGluZSB3aWR0aCBiZWZvcmUgd3JpdGluZyBwaXhlbHMuIFRoZSByYXcgcGFj
a2V0IHBhdGggKGxpbmUgNDAzKQp8IGNvcnJlY3RseSBjbGFtcHMgd2l0aCBzdGQ6Om1pbiwgYnV0
IFJMRSBwYXRocyBza2lwIHRoaXMgY2hlY2suIEEKfCBjcmFmdGVkIC5waWMgZmlsZSBjYXVzZXMg
aGVhcCBvdmVyZmxvdyB1cCB0byA2NTUzNSBieXRlcy4gVGhpcwp8IHZ1bG5lcmFiaWxpdHkgaXMg
Zml4ZWQgaW4gMy4wLjE4LjAgYW5kIDMuMS4xMy4wLgoKCkNWRS0yMDI2LTQzOTA1WzJdOgp8IE9w
ZW5JbWFnZUlPIGlzIGEgdG9vbHNldCBmb3IgcmVhZGluZywgd3JpdGluZywgYW5kIG1hbmlwdWxh
dGluZwp8IGltYWdlIGZpbGVzIG9mIGFueSBpbWFnZSBmaWxlIGZvcm1hdCByZWxldmFudCB0byBW
RlggLyBhbmltYXRpb24uCnwgUHJpb3IgdG8gMy4wLjE4LjAgYW5kIDMuMS4xMy4wLCBqcGVnMjAw
MGlucHV0LmNwcDozOTUgY29tcHV0ZXMKfCBidWZmZXIgc2l6ZSBhcyBjb25zdCBpbnQgYnVmc2l6
ZSA9IHcgKiBoICogY2ggKiBidWZmZXJfYnBwIHVzaW5nCnwgc2lnbmVkIDMyLWJpdCBhcml0aG1l
dGljLiBXaGVuIHRoZSBwcm9kdWN0IGV4Y2VlZHMgSU5UX01BWCwgdGhlCnwgcmVzdWx0IHdyYXBz
IHRvIDAgb3IgYSBzbWFsbCB2YWx1ZS4gbV9idWYucmVzaXplKCkgYWxsb2NhdGVzIGFuCnwgdW5k
ZXJzaXplZCBidWZmZXIsIGFuZCBzdWJzZXF1ZW50IHBpeGVsIHdyaXRlIGxvb3BzIGNhdXNlIGhl
YXAKfCBvdmVyZmxvdy4gQ29uZGl0aW9uYWwgb24gVVNFX09QRU5KUEggYnVpbGQgZmxhZy4gVGhp
cyB2dWxuZXJhYmlsaXR5CnwgaXMgZml4ZWQgaW4gMy4wLjE4LjAgYW5kIDMuMS4xMy4wLgoKCkNW
RS0yMDI2LTQzOTA2WzNdOgp8IE9wZW5JbWFnZUlPIGlzIGEgdG9vbHNldCBmb3IgcmVhZGluZywg
d3JpdGluZywgYW5kIG1hbmlwdWxhdGluZwp8IGltYWdlIGZpbGVzIG9mIGFueSBpbWFnZSBmaWxl
IGZvcm1hdCByZWxldmFudCB0byBWRlggLyBhbmltYXRpb24uCnwgUHJpb3IgdG8gMy4wLjE4LjAg
YW5kIDMuMS4xMy4wLCBhIGhlYXAtYmFzZWQgYnVmZmVyIG92ZXJmbG93IGluIHRoZQp8IEhFSUYg
ZGVjb2RlciBvZiBPcGVuSW1hZ2VJTyBhbGxvd3Mgb3V0LW9mLWJvdW5kcyB3cml0ZXMgdmlhIGNy
YWZ0ZWQKfCBpbWFnZXMgZHVlIHRvIGEgc3ViaW1hZ2UgbWV0YWRhdGEgbWlzbWF0Y2gsIGxlYWRp
bmcgdG8gbWVtb3J5CnwgY29ycnVwdGlvbiBhbmQgcG90ZW50aWFsIGNvZGUgZXhlY3V0aW9uLiBU
aGlzIHZ1bG5lcmFiaWxpdHkgaXMgZml4ZWQKfCBpbiAzLjAuMTguMCBhbmQgMy4xLjEzLjAuCgoK
Q1ZFLTIwMjYtNDM5MDdbNF06CnwgT3BlbkltYWdlSU8gaXMgYSB0b29sc2V0IGZvciByZWFkaW5n
LCB3cml0aW5nLCBhbmQgbWFuaXB1bGF0aW5nCnwgaW1hZ2UgZmlsZXMgb2YgYW55IGltYWdlIGZp
bGUgZm9ybWF0IHJlbGV2YW50IHRvIFZGWCAvIGFuaW1hdGlvbi4KfCBQcmlvciB0byAzLjAuMTgu
MCBhbmQgMy4xLjEzLjAsIGEgc2lnbmVkIGludGVnZXIgb3ZlcmZsb3cgaW4KfCBRdWVyeVJHQkJ1
ZmZlclNpemVJbnRlcm5hbCgpIGluIERQWENvbG9yQ29udmVydGVyLmNwcCBsZWFkcyB0byBhCnwg
aGVhcC1iYXNlZCBvdXQtb2YtYm91bmRzIHdyaXRlIHdoZW4gcHJvY2Vzc2luZyBjcmFmdGVkIERQ
WCBpbWFnZQp8IGZpbGVzLiBUaGUgZnVuY3Rpb24gY29tcHV0ZXMgYnVmZmVyIHNpemVzIHVzaW5n
IDMyLWJpdCBzaWduZWQKfCBpbnRlZ2VyIGFyaXRobWV0aWMgd2l0aCBuZWdhdGl2ZSBtdWx0aXBs
aWVycyAoZS5nLiwgcGl4ZWxzICogLTMgKgp8IGJ5dGVzIGZvciBrQ2JZQ3IgZGVzY3JpcHRvcnMg
YW5kIHBpeGVscyAqIC00ICogYnl0ZXMgZm9yIGtBQkdSCnwgZGVzY3JpcHRvcnMpLCB3aGVyZSBh
IG5lZ2F0aXZlIHJlc3VsdCBpcyB1c2VkIGFzIGFuIGluLWJhbmQgc2lnbmFsCnwgdGhhdCBubyBz
ZXBhcmF0ZSBidWZmZXIgaXMgbmVlZGVkLiBXaGVuIHRoZSBwaXhlbCBjb3VudCBpcwp8IHN1ZmZp
Y2llbnRseSBsYXJnZSwgdGhlIG11bHRpcGxpY2F0aW9uIG92ZXJmbG93cyBJTlRfTUlOIGFuZCB3
cmFwcwp8IHRvIGEgc21hbGwgcG9zaXRpdmUgdmFsdWUuIFRoZSBjYWxsZXIgaW4gZHB4aW5wdXQu
Y3BwIGludGVycHJldHMKfCB0aGlzIHBvc2l0aXZlIHZhbHVlIGFzIGEgcmVxdWlyZWQgYnVmZmVy
IHNpemUsIGFsbG9jYXRlcyBhbgp8IHVuZGVyc2l6ZWQgaGVhcCBidWZmZXIgdmlhIG1fZGVjb2Rl
YnVmLnJlc2l6ZSgpLCBhbmQgdGhlbiB3cml0ZXMgdGhlCnwgZnVsbCBpbWFnZSBkYXRhIGludG8g
aXQgdmlhIGZyZWFkLCByZXN1bHRpbmcgaW4gYSBoZWFwIGJ1ZmZlcgp8IG92ZXJmbG93LiBBbiBh
dHRhY2tlciBjYW4gZXhwbG9pdCB0aGlzIGJ5IGNyYWZ0aW5nIGEgRFBYIGZpbGUgdGhhdAp8IHRy
aWdnZXJzIHRoZSBvdmVyZmxvdywgY2F1c2luZyBhIGRlbmlhbCBvZiBzZXJ2aWNlIChjcmFzaCkg
b3IKfCBwb3RlbnRpYWxseSBhcmJpdHJhcnkgY29kZSBleGVjdXRpb24gdGhyb3VnaCBoZWFwIGNv
cnJ1cHRpb24gaW4gYW55CnwgYXBwbGljYXRpb24gdGhhdCByZWFkcyBwaXhlbCBkYXRhIHVzaW5n
IE9wZW5JbWFnZUlPLiBUaGlzCnwgdnVsbmVyYWJpbGl0eSBpcyBmaXhlZCBpbiAzLjAuMTguMCBh
bmQgMy4xLjEzLjAuCgoKQ1ZFLTIwMjYtNDM5MDhbNV06CnwgT3BlbkltYWdlSU8gaXMgYSB0b29s
c2V0IGZvciByZWFkaW5nLCB3cml0aW5nLCBhbmQgbWFuaXB1bGF0aW5nCnwgaW1hZ2UgZmlsZXMg
b2YgYW55IGltYWdlIGZpbGUgZm9ybWF0IHJlbGV2YW50IHRvIFZGWCAvIGFuaW1hdGlvbi4KfCBQ
cmlvciB0byAzLjAuMTguMCBhbmQgMy4xLjEzLjAsIGEgc2lnbmVkIDMyLWJpdCBpbnRlZ2VyIG92
ZXJmbG93IGluCnwgdGhlIHBpeGVsLWxvb3AgaW5kZXggZXhwcmVzc2lvbiBpICogMyBpbnNpZGUg
Q29udmVydENiWUNyWVRvUkdCKCkKfCBjYXVzZXMgdGhlIGZ1bmN0aW9uIHRvIGNvbXB1dGUgYSBs
YXJnZSBuZWdhdGl2ZSBwb2ludGVyIG9mZnNldCBpbnRvCnwgdGhlIG91dHB1dCBidWZmZXIsIHBy
b2R1Y2luZyBhbiBvdXQtb2YtYm91bmRzIHdyaXRlIHRoYXQgY3Jhc2hlcyB0aGUKfCBwcm9jZXNz
LiBUaGlzIHZ1bG5lcmFiaWxpdHkgaXMgZml4ZWQgaW4gMy4wLjE4LjAgYW5kIDMuMS4xMy4wLgoK
CkNWRS0yMDI2LTQzOTA5WzZdOgp8IE9wZW5JbWFnZUlPIGlzIGEgdG9vbHNldCBmb3IgcmVhZGlu
Zywgd3JpdGluZywgYW5kIG1hbmlwdWxhdGluZwp8IGltYWdlIGZpbGVzIG9mIGFueSBpbWFnZSBm
aWxlIGZvcm1hdCByZWxldmFudCB0byBWRlggLyBhbmltYXRpb24uCnwgUHJpb3IgdG8gMy4wLjE4
LjAgYW5kIDMuMS4xMy4wLCBhIHNpZ25lZCAzMi1iaXQgaW50ZWdlciBvdmVyZmxvdyBpbgp8IHRo
ZSBsb29wIGluZGV4IGV4cHJlc3Npb24gaSAqIDQgaW5zaWRlIFN3YXBSR0JBQnl0ZXMoKSBjYXVz
ZXMgdGhlCnwgZnVuY3Rpb24gdG8gY29tcHV0ZSBhIGxhcmdlIG5lZ2F0aXZlIHBvaW50ZXIgb2Zm
c2V0IHdoZW4gcHJvY2Vzc2luZwp8IGtBQkdSIERQWCBpbWFnZXMgd2l0aCBsYXJnZSBkaW1lbnNp
b25zLiBUaGUgaW1tZWRpYXRlIGNyYXNoIGlzIGFuCnwgb3V0LW9mLWJvdW5kcyByZWFkICh0aGUg
bWVtY3B5IGF0IGxpbmUgNDUgcmVhZHMgZnJvbSAmaW5wdXRbaSAqIDRdCnwgZmlyc3QpLCBidXQg
dGhlIHN1YnNlcXVlbnQgd3JpdGUgb3BlcmF0aW9ucyBhdCBsaW5lcyA0NuKAkzQ5IHRhcmdldAp8
IHRoZSBzYW1lIHdyYXBwZWQgb2Zmc2V0IOKAlCBtYWtpbmcgdGhpcyBhIGNvbWJpbmVkIE9PQiBy
ZWFkK3dyaXRlCnwgcHJpbWl0aXZlLiBUaGlzIHZ1bG5lcmFiaWxpdHkgaXMgZml4ZWQgaW4gMy4w
LjE4LjAgYW5kIDMuMS4xMy4wLgoKCkNWRS0yMDI2LTQzOTk2WzddOgp8IE9wZW5JbWFnZUlPIGlz
IGEgdG9vbHNldCBmb3IgcmVhZGluZywgd3JpdGluZywgYW5kIG1hbmlwdWxhdGluZwp8IGltYWdl
IGZpbGVzIG9mIGFueSBpbWFnZSBmaWxlIGZvcm1hdCByZWxldmFudCB0byBWRlggLyBhbmltYXRp
b24uCnwgUHJpb3IgdG8gMy4wLjE4LjAgYW5kIDMuMS4xMy4wLCB0aGUgYm91bmRzIGNoZWNrIGlu
CnwgVEdBSW5wdXQ6OmRlY29kZV9waXhlbCBjb21wdXRlcyBrICsgcGFsYnl0ZXNwcCBhcyB1bnNp
Z25lZCAzMi1iaXQKfCBhcml0aG1ldGljLiBXaGVuIGsgPSAweEZGRkZGRkZDIGFuZCBwYWxieXRl
c3BwID0gNCwgdGhlIGFkZGl0aW9uCnwgd3JhcHMgdG8gMCwgd2hpY2ggY29tcGFyZXMgbGVzcyB0
aGFuIHBhbGV0dGVfYWxsb2Nfc2l6ZSBhbmQgcGFzc2VzCnwgdGhlIGNoZWNrLiBUaGUgc3Vic2Vx
dWVudCBwYWxldHRlIGFjY2VzcyB1c2VzIHRoZSB1bndyYXBwZWQgawp8ICgweEZGRkZGRkZDKSBh
cyB0aGUgaW5kZXgsIHJlYWRpbmcgfjQgR0IgcGFzdCB0aGUgc3RhcnQgb2YgdGhlCnwgcGFsZXR0
ZSBidWZmZXIg4oCUIFNFR1YuIFRoaXMgdnVsbmVyYWJpbGl0eSBpcyBmaXhlZCBpbiAzLjAuMTgu
MCBhbmQKfCAzLjEuMTMuMC4KCgpJZiB5b3UgZml4IHRoZSB2dWxuZXJhYmlsaXRpZXMgcGxlYXNl
IGFsc28gbWFrZSBzdXJlIHRvIGluY2x1ZGUgdGhlCkNWRSAoQ29tbW9uIFZ1bG5lcmFiaWxpdGll
cyAmIEV4cG9zdXJlcykgaWRzIGluIHlvdXIgY2hhbmdlbG9nIGVudHJ5LgoKRm9yIGZ1cnRoZXIg
aW5mb3JtYXRpb24gc2VlOgoKWzBdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3Jn
L3RyYWNrZXIvQ1ZFLTIwMjYtNDM5MDMKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3Jk
P2lkPUNWRS0yMDI2LTQzOTAzClsxXSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9y
Zy90cmFja2VyL0NWRS0yMDI2LTQzOTA0CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29y
ZD9pZD1DVkUtMjAyNi00MzkwNApbMl0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5v
cmcvdHJhY2tlci9DVkUtMjAyNi00MzkwNQogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNv
cmQ/aWQ9Q1ZFLTIwMjYtNDM5MDUKWzNdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4u
b3JnL3RyYWNrZXIvQ1ZFLTIwMjYtNDM5MDYKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVj
b3JkP2lkPUNWRS0yMDI2LTQzOTA2Cls0XSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFu
Lm9yZy90cmFja2VyL0NWRS0yMDI2LTQzOTA3CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJl
Y29yZD9pZD1DVkUtMjAyNi00MzkwNwpbNV0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlh
bi5vcmcvdHJhY2tlci9DVkUtMjAyNi00MzkwOAogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVS
ZWNvcmQ/aWQ9Q1ZFLTIwMjYtNDM5MDgKWzZdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJp
YW4ub3JnL3RyYWNrZXIvQ1ZFLTIwMjYtNDM5MDkKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZF
UmVjb3JkP2lkPUNWRS0yMDI2LTQzOTA5Cls3XSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGVi
aWFuLm9yZy90cmFja2VyL0NWRS0yMDI2LTQzOTk2CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NW
RVJlY29yZD9pZD1DVkUtMjAyNi00Mzk5NgoKUmVnYXJkcywKU2FsdmF0b3JlCg==
]