CVE-2025-15506

Jan. 11, 2026, 11:15 a.m.

4.8
Medium

Description

A vulnerability was found in AcademySoftwareFoundation OpenColorIO up to 2.5.0. This issue affects the function ConvertToRegularExpression of the file src/OpenColorIO/FileRules.cpp. Performing a manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named ebdbb75123c9d5f4643e041314e2bc988a13f20d. To fix this issue, it is recommended to deploy a patch. The fix was added to the 2.5.1 milestone.

Product(s) Impacted

Vendor Product Versions
Academysoftwarefoundation
  • Opencolorio
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a academysoftwarefoundation opencolorio / / / / / / / /

References

https://github.com/AcademySoftwareFoundation/OpenColorIO/issues/2228
https://github.com/AcademySoftwareFoundation/OpenColorIO/milestone/11
https://github.com/AcademySoftwareFoundation/OpenColorIO/pull/2231
https://github.com/cozdas/OpenColorIO/commit/ebdbb75123c9d5f4643e041314e2bc988a13f20d
https://github.com/oneafter/1225/blob/main/uaf
https://vuldb.com/?ctiid.340444
https://vuldb.com/?id.340444
https://vuldb.com/?submit.733332

Tags

CWE-119
cna@vuldb.com
2026-01-11
CVE-2025-15506

CVSS Score

4.8 / 10

CVSS Data - 4.0

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: LOW
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: LOW
  • Exploit Maturity: PROOF_OF_CONCEPT

    • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: Jan. 11, 2026, 11:15 a.m.
Last Modified: Jan. 11, 2026, 11:15 a.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@vuldb.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.