Source: openimageio X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for openimageio. CVE-2026-65969[0]: | OpenImageIO is a toolset for reading, writing, and manipulating | image files of any image file format relevant to VFX / animation. | Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can | leave a pending gif frame that is processed during output close. | gifsplitpalette() computes numpixels multiplied by the palette | partition width in signed 32-bit arithmetic; a large image overflows | that intermediate, corrupts subpixelsa, and drives an out-of-bounds | read while building the gif palette, resulting in a process crash | and denial of service. The affected implementation is identified by | src/gif.imageio/gif.h, GifSplitPalette(), numPixels, subPixelsA, | GIFOutput, and truncated TGA input, which define the relevant source | path, functions, state, and trigger. This issue is fixed in versions | 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9mwc-fjgj-8wmq https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5292 https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/134977da625a84fc5a09a34321806f1fe0093c24 (v3.2.0.3-beta1) CVE-2026-63638[1]: | OpenImageIO is a toolset for reading, writing, and manipulating | image files of any image file format relevant to VFX / animation. | Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon | image can declare unsupported component bit depth 26. | cineoninput::open() maps it to a 32-bit imagespec, but libcineon | maps the unsupported depth to an 8-byte value, so | cineoninput::read_native_scanline() causes attacker-controlled data | to be written beyond the 4-byte-per-pixel caller buffer, resulting | in a heap out-of-bounds write and memory corruption. The affected | implementation is identified by src/cineon.imageio/cineoninput.cpp, | CineonInput::open(), CineonInput::read_native_scanline(), | ComponentDataSize(), bit depth 26, and ImageSpec, which define the | relevant source path, functions, state, and trigger. This issue is | fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9hxv-jvgr-3x8g https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5283 https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/6f2b2e85b3b3933ccc5a46303d5535f99bfa39fb (v3.2.0.3-beta1) CVE-2026-63635[2]: | OpenImageIO is a toolset for reading, writing, and manipulating | image files of any image file format relevant to VFX / animation. | Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with | an invalid color_mode bypasses normal validation when oiio:rawcolor | or psd:rawdata is enabled. psdinput::setup() then uses the attacker- | controlled value to index fixed color-mode tables, causing a global | out-of-bounds read and potentially a bogus allocation, resulting in | denial of service. The affected implementation is identified by | src/psd.imageio/psdinput.cpp, PSDInput::validate_header(), | PSDInput::setup(), oiio:RawColor, psd:RawData, color_mode, and | mode_channel_count, which define the relevant source path, | functions, state, and trigger. This issue is fixed in versions | 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3c8w-9xvm-r6gf https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5282 https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/50481b0f90932a4675f65f3cc26407139cb9e20e (v3.2.0.3-beta1) CVE-2026-63422[3]: | OpenImageIO is a toolset for reading, writing, and manipulating | image files of any image file format relevant to VFX / animation. | Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled | openexr image whose width is not a multiple of its tile width can | trigger an overflow when a caller reads a partial edge-tile | rectangle. openexrinput::read_native_tiles() copies each row into | the caller buffer using the padded whole-tile scanline_stride rather | than user_scanline_bytes for the requested rectangle, resulting in a | heap out-of-bounds write and memory corruption. The affected | implementation is identified by src/openexr.imageio/exrinput.cpp, | OpenEXRInput::read_native_tiles(), partial edge tile, | user_scanline_bytes, and scanline_stride, which define the relevant | source path, functions, state, and trigger. This issue is fixed in | versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh5r-whph-qmc5 https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5295 https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/7303134f13b0f9dc738b8ecabecd8c9f90cbd4c9 (v3.2.0.3-beta1) CVE-2026-63420[4]: | OpenImageIO is a toolset for reading, writing, and manipulating | image files of any image file format relevant to VFX / animation. | Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with | transparency metadata creates fewer stored channel_buffers than the | spec.nchannels value advertised by the rawcolor path. when | oiio:rawcolor or psd:rawdata is enabled, | psdinput::read_native_scanline() passes spec.nchannels to | psdinput::interleave_row(), which indexes beyond channel_buffers, | resulting in a heap out-of-bounds read and process crash. The | affected implementation is identified by | src/psd.imageio/psdinput.cpp, PSDInput::read_native_scanline(), | PSDInput::interleave_row(), oiio:RawColor, psd:RawData, | channel_buffers, and spec.nchannels, which define the relevant | source path, functions, state, and trigger. This issue is fixed in | versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5307 https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/4995b25b8216552630e0aee0d8870e0d3aaae7ee (v3.2.0.3-beta1) CVE-2026-63419[5]: | OpenImageIO is a toolset for reading, writing, and manipulating | image files of any image file format relevant to VFX / animation. | Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled | iff is exposed with a 16-bit public imagespec while the decoder | retains a 32-bit internal pixel size. iffinput::read_native_tile() | copies according to m_header.pixel_bytes() rather than | imagespec::tile_bytes(true), and a failed read can leave m_buf | nonempty so a later call copies partially initialized data into the | undersized caller buffer, resulting in a heap out-of-bounds write | and memory corruption. The affected implementation is identified by | src/iff.imageio/iffinput.cpp, IffInput::read_native_tile(), | ImageSpec::tile_bytes(true), m_header.pixel_bytes(), ZBUFFER, and | m_buf, which define the relevant source path, functions, state, and | trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and | 3.2.0.3-beta1. https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-w6wc-gcf4-5pj2 https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5268 https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/9cda48b150294c7f024e680a6c9b0402e50f4816 (v3.2.0.3-beta1) CVE-2026-59956[6]: | OpenImageIO is a toolset for reading, writing, and manipulating | image files of any image file format relevant to VFX / animation. | Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, An uncompressed | 16-bit iff image with a z-buffer makes iffinput::readimg() allocate | a temporary scanline from m_header.rgba_count but copy from it using | m_header.pixel_bytes(), whose stride also includes z-buffer bytes. | the oversized memcpy reads beyond the temporary heap buffer and | copies adjacent memory into the output image, resulting in a crash | or disclosure of adjacent heap data. The affected implementation is | identified by src/iff.imageio/iffinput.cpp, IffInput::readimg(), | m_header.rgba_count, and m_header.pixel_bytes(), which define the | relevant source path, functions, state, and trigger. This issue is | fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1. https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-hjfv-gvxc-qgvh https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5251 https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/f01bd16764b2a06f372899e3e302280a7f9c8c02 (v3.2.0.3-beta1) CVE-2026-59181[7]: | OpenImageIO is a toolset for reading, writing, and manipulating | image files of any image file format relevant to VFX / animation. | Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted cineon | file can supply a numberofelements value greater than the format | maximum of eight. cineoninput::open() uses that unchecked value as | the loop bound while filling the fixed strings[8] array, writing | pointers beyond the stack buffer and into adjacent state, resulting | in memory corruption and denial of service. The affected | implementation is identified by src/cineon.imageio/cineoninput.cpp, | CineonInput::open(), numberOfElements, and strings[8], which define | the relevant source path, functions, state, and trigger. This issue | is fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1. https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh8r-vmqq-56pp https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5250 https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/908f22f5528e88e5e96184c194caa26b54b2b85f (v3.2.0.3-beta1) CVE-2026-59156[8]: | OpenImageIO is a toolset for reading, writing, and manipulating | image files of any image file format relevant to VFX / animation. | Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits | stream containing consecutive 2880-byte header blocks without the | mandatory end keyword makes fitsinput::read_fits_header() call | itself without a depth bound. repeated recursive parsing exhausts | the application stack, resulting in denial of service. The affected | implementation is identified by src/fits.imageio/fitsinput.cpp, | FitsInput::read_fits_header(), END keyword, and 2880-byte FITS | header blocks, which define the relevant source path, functions, | state, and trigger. This issue is fixed in versions 3.0.20.0, | 3.1.15.0, and 3.2.0.3-beta1. https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xvwr-x6ch-v2fq https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5248 https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/b0de7d40d06eb4abc7ef14c1321a1a2a976d8c1c (v3.2.0.3-beta1) If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-65969 https://www.cve.org/CVERecord?id=CVE-2026-65969 [1] https://security-tracker.debian.org/tracker/CVE-2026-63638 https://www.cve.org/CVERecord?id=CVE-2026-63638 [2] https://security-tracker.debian.org/tracker/CVE-2026-63635 https://www.cve.org/CVERecord?id=CVE-2026-63635 [3] https://security-tracker.debian.org/tracker/CVE-2026-63422 https://www.cve.org/CVERecord?id=CVE-2026-63422 [4] https://security-tracker.debian.org/tracker/CVE-2026-63420 https://www.cve.org/CVERecord?id=CVE-2026-63420 [5] https://security-tracker.debian.org/tracker/CVE-2026-63419 https://www.cve.org/CVERecord?id=CVE-2026-63419 [6] https://security-tracker.debian.org/tracker/CVE-2026-59956 https://www.cve.org/CVERecord?id=CVE-2026-59956 [7] https://security-tracker.debian.org/tracker/CVE-2026-59181 https://www.cve.org/CVERecord?id=CVE-2026-59181 [8] https://security-tracker.debian.org/tracker/CVE-2026-59156 https://www.cve.org/CVERecord?id=CVE-2026-59156 Please adjust the affected versions in the BTS as needed.
