OpenImageIO Vulnerability in PSD File Handling by Academy Software Foundation
CVE-2026-63635
5.5MEDIUM
What is CVE-2026-63635?
A vulnerability in OpenImageIO, a widely used toolset for image manipulation, allows crafted PSD files with invalid color modes to bypass validation checks. This flaw can lead to out-of-bounds memory access when processing these files, which may result in denial of service conditions. Specifically, the issue arises when certain properties like oiio:rawcolor or psd:rawdata are enabled, leading to improper handling of attacker-controlled values and potentially causing system instability. This has been addressed in the latest versions: 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Affected Version(s)
OpenImageIO < 3.0.21.0 < 3.0.21.0
OpenImageIO >= 3.1.0.0, < 3.1.16.0 < 3.1.0.0, 3.1.16.0
OpenImageIO >= 3.2.0.0-dev, < 3.2.0.3-beta1 < 3.2.0.0-dev, 3.2.0.3-beta1