{"id":"CVE-2026-63419","title":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation","summary":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public im…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-787"],"vendor":"AcademySoftwareFoundation","product":"OpenImageIO","affected":["OpenImageIO < 3.0.21.0","OpenImageIO >= 3.1.0.0, < 3.1.16.0","OpenImageIO >= 3.2.0.0-dev, < 3.2.0.3-beta1"],"published":"2026-09-18","updated":"2026-09-24","sourceUpdated":"2026-09-24T21:22:19.873","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63419","references":[{"url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/9cda48b150294c7f024e680a6c9b0402e50f4816","label":"security-advisories@github.com"},{"url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5268","label":"security-advisories@github.com"},{"url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.21.0","label":"security-advisories@github.com"},{"url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0","label":"security-advisories@github.com"},{"url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-w6wc-gcf4-5pj2","label":"security-advisories@github.com"},{"url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-w6wc-gcf4-5pj2","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00186,"epssPercentile":0.07286,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-18T17:33:32.010538Z"},"ingestedAt":"2026-09-18T16:45:41.387Z","slug":"CVE-2026-63419","body":"## Overview\n\nOpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel size. iffinput::read_native_tile() copies according to m_header.pixel_bytes() rather than imagespec::tile_bytes(true), and a failed read can leave m_buf nonempty so a later call copies partially initialized data into the undersized caller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/iff.imageio/iffinput.cpp, IffInput::read_native_tile(), ImageSpec::tile_bytes(true), m_header.pixel_bytes(), ZBUFFER, and m_buf, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":207062,"id":"CVE-2026-63419","ts":1789753651709,"field":"exploit_available","old":"false","new":"true"}]}