Hi,

The following vulnerability was published for opencolorio.

CVE-2026-42450[0]:
| OpenColorIO is a color management framework for visual effects and
| animation. Prior to version 2.5.2, `FileFormatSpi3D.cpp:163` uses
| `sscanf` with `%s` into 64-byte stack buffers when parsing LUT data
| lines. Input comes from `lineBuffer[4096]`, so a crafted .spi3d file
| can overflow by ~4000 bytes on non-Windows. Version 2.5.2 fixes the
| issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-42450
https://www.cve.org/CVERecord?id=CVE-2026-42450
[1] https://github.com/AcademySoftwareFoundation/OpenColorIO/security/advisories/GHSA-rxp3-rrgx-f547

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
opencolorio, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141498@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Matteo F. Vescovi <mfv@debian.org> (supplier of updated opencolorio package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 07 Oct 2026 21:01:07 +0200
Source: opencolorio
Binary: libopencolorio-dev libopencolorio2.6 libopencolorio2.6-dbgsym opencolorio-tools python3-pyopencolorio
Architecture: source amd64
Version: 2.6.0+dfsg-1
Distribution: experimental
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel@lists.alioth.debian.org>
Changed-By: Matteo F. Vescovi <mfv@debian.org>
Description:
 libopencolorio-dev - complete color management solution - development
 libopencolorio2.6 - complete color management solution - runtime
 opencolorio-tools - complete color management solution - utilities
 python3-pyopencolorio - complete color management solution - Python bindings
Closes: 1141498
Changes:
 opencolorio (2.6.0+dfsg-1) experimental; urgency=medium
 .
   * New upstream release (Closes: #1141498)
     This release fixes CVE-2026-42450:
     | OpenColorIO is a color management framework for visual effects and
     | animation. Prior to version 2.5.2, `FileFormatSpi3D.cpp:163` uses
     | `sscanf` with `%s` into 64-byte stack buffers when parsing LUT data
     | lines. Input comes from `lineBuffer[4096]`, so a crafted .spi3d file
     | can overflow by ~4000 bytes on non-Windows.
   * debian/: SONAME bump 2.5 -> 2.6
   * debian/control: debhelper bump 13 -> 14
   * debian/control: S-V bump 4.7.3 -> 4.7.4 (no changes needed)
Checksums-Sha1:
 7b00c18ca1b338273ac64eddd34c09e58f1a93f4 2983 opencolorio_2.6.0+dfsg-1.dsc
 ef31b8bc33e62e245788b71d07076e1d7cceafb9 10227756 opencolorio_2.6.0+dfsg.orig.tar.xz
 5fc67ae2e6820bf116a2d5615fa105f58fc147ef 18492 opencolorio_2.6.0+dfsg-1.debian.tar.xz
 b5ac390dfb1dcc76ea718aed8a8c5240fb3e7c7d 87952 libopencolorio-dev_2.6.0+dfsg-1_amd64.deb
 67682044a99f145a05cff52fc5703182b3f89968 36722708 libopencolorio2.6-dbgsym_2.6.0+dfsg-1_amd64.deb
 0fb828307336fd71934e4c0023c07339054d34b5 2081348 libopencolorio2.6_2.6.0+dfsg-1_amd64.deb
 0a3d08e7fa243090d42957e1d6ceec32eca4d28f 197628 opencolorio-tools_2.6.0+dfsg-1_amd64.deb
 3df13f9d4fe4c06f351a520cff7973689e807aab 17282 opencolorio_2.6.0+dfsg-1_amd64.buildinfo
 635dab401baedffb8f10220bfa5638bc797119c7 1210224 python3-pyopencolorio_2.6.0+dfsg-1_amd64.deb
Checksums-Sha256:
 dc9cbb68b3b31b0107f111df1ef2c84b15a22d39ee4f98fc371c41afce202ae9 2983 opencolorio_2.6.0+dfsg-1.dsc
 655b6d8ce11424fc64d6cd58f6d3f598aacc79d375d46b67cce77084b665850b 10227756 opencolorio_2.6.0+dfsg.orig.tar.xz
 c47aaaaf7c71f600d6f35fe207eaea7fc15eed9c2c252880ef920703e1ae7417 18492 opencolorio_2.6.0+dfsg-1.debian.tar.xz
 0caf451912cd25d727a8d9d1526dffd564b932c4d31f4dc86520f78c3e784d63 87952 libopencolorio-dev_2.6.0+dfsg-1_amd64.deb
 0aa3d8628445d0e58743600a5d2eac83a57bd9401434801f32934904192a4eac 36722708 libopencolorio2.6-dbgsym_2.6.0+dfsg-1_amd64.deb
 de4e077568b3a41935a464192347016167915db90be3ea73ae7b95250b89584c 2081348 libopencolorio2.6_2.6.0+dfsg-1_amd64.deb
 510bb4e16526a25c4d61bf895f27a52bc611eaae772fb0952f713687da219d14 197628 opencolorio-tools_2.6.0+dfsg-1_amd64.deb
 82391b2ec38c1c33eb868782a437fc11c7980d3930395d331d02aff8d4d34e62 17282 opencolorio_2.6.0+dfsg-1_amd64.buildinfo
 a745b89e4e66b4362fe47e17a0888fc73b60932c797686e403becfc9847828a0 1210224 python3-pyopencolorio_2.6.0+dfsg-1_amd64.deb
Files:
 aec5fedd8b001b7e77b2e25a097ebea8 2983 libs optional opencolorio_2.6.0+dfsg-1.dsc
 2129f8ccf5f21638a900bf354833cdb9 10227756 libs optional opencolorio_2.6.0+dfsg.orig.tar.xz
 2ead9b0dc1a5100cd33dd656e4d01316 18492 libs optional opencolorio_2.6.0+dfsg-1.debian.tar.xz
 415b03428a30efda19cd79483bd9a3ca 87952 libdevel optional libopencolorio-dev_2.6.0+dfsg-1_amd64.deb
 14246b3ef09471deeeb4c6547fd70baf 36722708 debug optional libopencolorio2.6-dbgsym_2.6.0+dfsg-1_amd64.deb
 3a303ca9f56b9b568d570fbb89543b6d 2081348 libs optional libopencolorio2.6_2.6.0+dfsg-1_amd64.deb
 233814f5619020fc8ffb44c87fed06ee 197628 utils optional opencolorio-tools_2.6.0+dfsg-1_amd64.deb
 5d51c6baa72862a7b7ffbc5309c3e264 17282 libs optional opencolorio_2.6.0+dfsg-1_amd64.buildinfo
 f075945036b01444e9a4ab4ce436a524 1210224 python optional python3-pyopencolorio_2.6.0+dfsg-1_amd64.deb
iQKTBAEBCgB9FiEE890J+NqH0d9QRsmbBhL0lE7NzVoFAmrGnEpfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEYz
REQwOUY4REE4N0QxREY1MDQ2Qzk5QjA2MTJGNDk0NEVDRENENUEACgkQBhL0lE7N
zVrQWA//bM6qOaxw7V/BtKmTK9c37LTG6uSkVkSzSTiA6dFvcXj+ET/DFxAx1Mlw
71kx0XT3ZClS50ChZ5r07fslJK+y3SUKjPCCNHoEQk5JLpmCoGbvLI+RogKP7N7H
3cnv75xJJIUIXEDcaskWv5EhqU2jZkCRpont0T31tNp3Uu4IIQLDjtma4dQ+n8cN
lo94BVuiPmhtn/Hrnoo2xFJkAWs+hHzV3VuicmkUjNuYkdD8qD63+Tbgde56gVoi
ehhWQxH33lTjSPUcev3dBiYRYDdPc3Fo33hjy6gLFoNxhjrZHfjqAA7QGLV0Ribr
7F/OO1fY9U63QdjG+9C70r6xHYIL6ELkrFDJyQROSqQQx8DkcrIQpxMP2OTdx84k
5XrzBebWHdE7WavtjOgp68ZRNhHa+UBJO4hN6bPOEJkjrCNxz/UJfsMTgSbglNux
e05cb1PBzM8EskpDZZJYWQ9ju58AXEBpCf5LdSDux+87YhVctMsJZTMTrJThVBKQ
UeEYx3Z1CRrGEG3HVtwVETJGmD3+DI5vSN88Z7OTjg3qSULtA3C70JrwJgzkp5qH
QGB+wEb6Da0f+VxYn3f7YpkGecQZVS1zPLrxaxvm547+e8M5DbLqpdciiu3+jqmG
CNEmWWjrOQxCSWXhoIxPG1Dtm7ICmgz1JeIPYjsIGEQh0H8KQQc=
=O5M8
-----END PGP SIGNATURE-----