CVE-2026-63638

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. A crafted Cineon file with a huge declared width wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.

OpenImageIO is a toolset for reading, writing, and manipulating image files. Prior to 3.1.16.0, a crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::read_native_scanline_locked() nevertheless invokes tiffinput::bit_convert() with 8-bit output and writes one expanded byte per value into that smaller buffer, resulting in a heap out-of-bounds write and memory corruption. This issue is fixed in 3.1.16.0.

In OpenImageIO prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through an error path while asynchronous strip-decompression work remains queued. Because task_set is declared before ok and compressed_scratch, those captured objects are destroyed before the task-set destructor waits, allowing worker tasks to use stale stack and heap storage.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a truncated TGA can leave a pending GIF frame that is processed during output close. gifsplitpalette() computes numpixels multiplied by the palette partition width in signed 32-bit arithmetic; a large image overflows that intermediate, corrupts subpixelsa, and drives an out-of-bounds read while building the GIF palette.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a crafted PSD with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value to index fixed color-mode tables, causing a global out-of-bounds read and potentially a bogus allocation.

OpenImageIO is a toolset for reading, writing, and manipulating image files. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads a partial edge-tile rectangle. openexrinput::read_native_tiles() copies each row into the caller buffer using the padded whole-tile scanline_stride rather than user_scanline_bytes for the requested rectangle, resulting in a heap out-of-bounds write and memory corruption. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, an indexed PSD with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. When oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers.

OpenImageIO is a toolset for reading, writing, and manipulating image files. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel size. iffinput::read_native_tile() copies according to m_header.pixel_bytes() rather than imagespec::tile_bytes(true), and a failed read can leave m_buf nonempty so a later call copies partially initialized data into the undersized caller buffer, resulting in a heap out-of-bounds write and memory corruption. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, an uncompressed 16-bit IFF image with a z-buffer makes iffinput::readimg() allocate a temporary scanline from m_header.rgba_count but copy from it using m_header.pixel_bytes(), whose stride also includes z-buffer bytes. The oversized memcpy reads beyond the temporary heap buffer and copies adjacent memory into the output image.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, a crafted Cineon file can supply a numberofelements value greater than the format maximum of eight. cineoninput::open() uses that unchecked value as the loop bound while filling the fixed strings[8] array, writing pointers beyond the stack buffer and into adjacent state.