AcademySoftwareFoundation OpenImageIO up to 3.2.0.3-beta0 OpenEXR Input exrinput.cpp read_native_tiles out-of-bounds write

Summaryinfo

A vulnerability was found in AcademySoftwareFoundation OpenImageIO up to 3.2.0.3-beta0. It has been rated as critical. Affected by this vulnerability is the function OpenEXRInput::read_native_tiles of the file src/openexr.imageio/exrinput.cpp of the component OpenEXR Input. The manipulation leads to out-of-bounds write. This vulnerability is documented as CVE-2026-63422. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in AcademySoftwareFoundation OpenImageIO up to 3.2.0.3-beta0 and classified as critical. This issue affects the function OpenEXRInput::read_native_tiles of the file src/openexr.imageio/exrinput.cpp of the component OpenEXR Input. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads a partial edge-tile rectangle. openexrinput::read_native_tiles() copies each row into the caller buffer using the padded whole-tile scanline_stride rather than user_scanline_bytes for the requested rectangle, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/openexr.imageio/exrinput.cpp, OpenEXRInput::read_native_tiles(), partial edge tile, user_scanline_bytes, and scanline_stride, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-63422 since 07/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 3.0.21.0, 3.1.16.0 or 3.2.0.3-beta1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenImageIO

Version

• 3.2.0.3-beta0

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/OpenImageIO/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion