5.5

CVE-2026-65969

Exploit

OpenImageIO: TGA-to-GIF palette split signed overflow causes SIGSEGV

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette() computes numpixels multiplied by the palette partition width in signed 32-bit arithmetic; a large image overflows that intermediate, corrupts subpixelsa, and drives an out-of-bounds read while building the gif palette, resulting in a process crash and denial of service. The affected implementation is identified by src/gif.imageio/gif.h, GifSplitPalette(), numPixels, subPixelsA, GIFOutput, and truncated TGA input, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openimageio ≫ Openimageio Version < 3.0.21.0
Openimageio ≫ Openimageio Version >= 3.1.0.0 <= 3.1.16.0
Openimageio ≫ Openimageio Version 3.2.0.0 Update dev
Openimageio ≫ Openimageio Version 3.2.0.2 Update dev
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.03
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.21.0
Release Notes
https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0
Release Notes
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9mwc-fjgj-8wmq
Vendor Advisory
Exploit
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5292
Patch
Issue Tracking
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/134977da625a84fc5a09a34321806f1fe0093c24
Patch