AcademySoftwareFoundation OpenImageIO prior 3.0.21.0/3.1.16.0/3.2.0.3-beta1 PSD Input psdinput.cpp read_native_scanline spec.nchannels out-of-bounds

Summaryinfo

A vulnerability categorized as problematic has been discovered in AcademySoftwareFoundation OpenImageIO. Affected by this issue is the function PSDInput::read_native_scanline of the file src/psd.imageio/psdinput.cpp of the component PSD Input Handler. The manipulation of the argument spec.nchannels results in out-of-bounds. This vulnerability is reported as CVE-2026-63420. The attack requires a local approach. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in AcademySoftwareFoundation OpenImageIO. It has been classified as problematic. Affected is the function PSDInput::read_native_scanline of the file src/psd.imageio/psdinput.cpp of the component PSD Input Handler. The manipulation of the argument spec.nchannels with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on availability. CVE summarizes:

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. when oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers, resulting in a heap out-of-bounds read and process crash. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::read_native_scanline(), PSDInput::interleave_row(), oiio:RawColor, psd:RawData, channel_buffers, and spec.nchannels, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-63420 since 07/16/2026. The exploitability is told to be easy. Local access is required to approach this attack. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 3.0.21.0, 3.1.16.0 or 3.2.0.3-beta1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenImageIO

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/OpenImageIO/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion