PT-2026-1783 · Academy Software Foundation+1 · Opencolorio+1

Oneafter · Published 2026-01-11 · Updated 2026-01-11 · CVE-2025-15506

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions AcademySoftwareFoundation OpenColorIO versions through 2.5.0

Description An issue exists in AcademySoftwareFoundation OpenColorIO up to version 2.5.0 related to an out-of-bounds read condition. This occurs within the ConvertToRegularExpression function located in the src/OpenColorIO/FileRules.cpp file. Exploitation requires local access. The exploit for this issue has been publicly released. Increased actor activity targeting this software has been observed.

Recommendations Versions prior to 2.5.1 are affected. Deploy the patch ebdbb75123c9d5f4643e041314e2bc988a13f20d. Update to version 2.5.1 or later.

Exploit

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

CVE-2025-15506

GHSA-M86R-WR74-693H

Affected Products

Debian

Opencolorio

References · 22

• 🔥 https://github.com/oneafter/1225/blob/main/uaf · Exploit
• https://github.com/AcademySoftwareFoundation/OpenColorIO/milestone/11 · Patch
• https://osv.dev/vulnerability/GHSA-m86r-wr74-693h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15506 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-15506 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-15506 · Vendor Advisory
• https://github.com/cozdas/OpenColorIO/commit/ebdbb75123c9d5f4643e041314e2bc988a13f20d · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-15506 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-15506 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-15506 · Security Note
• https://ubuntu.com/security/CVE-2025-15506 · Vendor Advisory
• https://github.com/AcademySoftwareFoundation/OpenColorIO · Note
• https://github.com/AcademySoftwareFoundation/OpenColorIO/pull/2231 · Note
• https://github.com/AcademySoftwareFoundation/OpenColorIO/issues/2228 · Note
• https://vuldb.com/?submit.733332 · Note