AcademySoftwareFoundation OpenImageIO prior 3.0.21.0/3.1.16.0/3.2.0.3-beta1 PSD Input psdinput.cpp PSDInput::setup color_mode out-of-bounds

Summaryinfo

A vulnerability labeled as problematic has been found in AcademySoftwareFoundation OpenImageIO. This vulnerability affects the function PSDInput::setup of the file src/psd.imageio/psdinput.cpp of the component PSD Input Handler. Such manipulation of the argument color_mode leads to out-of-bounds. This vulnerability is traded as CVE-2026-63635. An attack has to be approached locally. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in AcademySoftwareFoundation OpenImageIO. It has been rated as problematic. Affected by this issue is the function PSDInput::setup of the file src/psd.imageio/psdinput.cpp of the component PSD Input Handler. The manipulation of the argument color_mode with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is availability. CVE summarizes:

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value to index fixed color-mode tables, causing a global out-of-bounds read and potentially a bogus allocation, resulting in denial of service. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::validate_header(), PSDInput::setup(), oiio:RawColor, psd:RawData, color_mode, and mode_channel_count, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-63635 since 07/17/2026. The exploitation is known to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 3.0.21.0, 3.1.16.0 or 3.2.0.3-beta1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenImageIO

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/OpenImageIO/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion