Heap Out-of-Bounds Write in OpenImageIO Affecting Animation Tools
CVE-2026-63638
8.3HIGH
What is CVE-2026-63638?
OpenImageIO, used for reading and manipulating image files in VFX and animation, contains a critical flaw that can lead to memory corruption. An attacker can exploit this vulnerability by crafting a cineon image with unsupported component bit depth 26, which causes cineoninput::read_native_scanline() to write data beyond the allocated buffer, resulting in potential unauthorized access and instability. Versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1 address this significant issue, enhancing the security of image processing tasks.
Affected Version(s)
OpenImageIO < 3.0.21.0 < 3.0.21.0
OpenImageIO >= 3.1.0.0, < 3.1.16.0 < 3.1.0.0, 3.1.16.0
OpenImageIO >= 3.2.0.0-dev, < 3.2.0.3-beta1 < 3.2.0.0-dev, 3.2.0.3-beta1