CVE-2025-15506
Unknown Unknown - Not Provided
Out-of-Bounds Read in OpenColorIO ConvertToRegularExpression Function

Publication date: 2026-01-11

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability was found in AcademySoftwareFoundation OpenColorIO up to 2.5.0. This issue affects the function ConvertToRegularExpression of the file src/OpenColorIO/FileRules.cpp. Performing a manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named ebdbb75123c9d5f4643e041314e2bc988a13f20d. To fix this issue, it is recommended to deploy a patch. The fix was added to the 2.5.1 milestone.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-11
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-01-11
EPSS Evaluated
2026-06-14
NVD
CVE-2025-15506
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
academysoftwarefoundation opencolorio to 2.5.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the OpenColorIO software up to version 2.5.0, specifically in the ConvertToRegularExpression function in the FileRules.cpp file. It allows an attacker with local access to cause an out-of-bounds read by manipulating the function, potentially leading to unexpected behavior or crashes. A patch has been released in version 2.5.1 to fix this issue.

Impact Analysis

The vulnerability can cause an out-of-bounds read when exploited locally, which may lead to application crashes or other unintended behavior. Although the impact is limited due to the need for local access and the low severity scores, it could still disrupt normal operations of the affected software.

Mitigation Strategies

To mitigate this vulnerability, it is recommended to deploy the patch identified by commit ebdbb75123c9d5f4643e041314e2bc988a13f20d and upgrade OpenColorIO to version 2.5.1 or later.

Detection Guidance

This vulnerability is a local out-of-bounds read issue triggered by malformed regular expressions in OpenColorIO configuration files. Detection involves compiling the OpenColorIO test harness with AddressSanitizer enabled and running it with specially crafted input that triggers the malformed regex parsing. Specifically, on a Linux x86_64 system, compile with Clang using the flags '-fsanitize=address -g' and then execute the test harness with a YAML file containing an invalid regex pattern. AddressSanitizer will report heap-use-after-free or out-of-bounds read errors during this test. Example commands: 1) Compile the test harness: clang++ -fsanitize=address -g -o ocio_test_harness src/test_harness.cpp (adjust source file as needed) 2) Run the harness with crafted input: ./ocio_test_harness malformed_regex_input.yaml This approach helps detect the vulnerability by triggering the faulty regex parsing and catching memory errors. There are no known network detection commands since the attack requires local access and malformed local config files. [2, 4]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15506. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart