Heap Overflow Vulnerability in OpenImageIO Affects Image Processing Functionality
CVE-2026-63422
7.8HIGH
What is CVE-2026-63422?
A vulnerability identified in OpenImageIO allows for a heap overflow when processing a valid tiled OpenEXR image. If the image's width is not a multiple of its tile width, reading a partial edge-tile rectangle can lead to a memory corruption issue. Specifically, the function openexrinput::read_native_tiles() incorrectly handles copying row data into the caller buffer, leading to an out-of-bounds write. This flaw has been addressed in newer versions, ensuring that users of OpenImageIO can process images without risking the integrity of their systems.
Affected Version(s)
OpenImageIO < 3.0.21.0 < 3.0.21.0
OpenImageIO >= 3.1.0.0, < 3.1.16.0 < 3.1.0.0, 3.1.16.0
OpenImageIO >= 3.2.0.0-dev, < 3.2.0.3-beta1 < 3.2.0.0-dev, 3.2.0.3-beta1