5.5

CVE-2026-63420

Exploit

OpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row`

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. when oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers, resulting in a heap out-of-bounds read and process crash. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::read_native_scanline(), PSDInput::interleave_row(), oiio:RawColor, psd:RawData, channel_buffers, and spec.nchannels, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openimageio ≫ Openimageio Version < 3.0.21.0
Openimageio ≫ Openimageio Version >= 3.1.0.0 <= 3.1.16.0
Openimageio ≫ Openimageio Version 3.2.0.0 Update dev
Openimageio ≫ Openimageio Version 3.2.0.2 Update dev
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.03
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

CWE-129 Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j
Vendor Advisory
Exploit
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5307
Patch
Issue Tracking
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/4995b25b8216552630e0aee0d8870e0d3aaae7ee
Patch
https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.21.0
Release Notes
https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0
Release Notes