AcademySoftwareFoundation OpenImageIO up to 3.0.20.9/3.1.15.9/3.2.0.2-beta1 Cineon Image cineoninput.cpp CineonInput::open out-of-bounds write

Summaryinfo

A vulnerability classified as critical has been found in AcademySoftwareFoundation OpenImageIO up to 3.0.20.9/3.1.15.9/3.2.0.2-beta1. This impacts the function CineonInput::open of the file src/cineon.imageio/cineoninput.cpp of the component Cineon Image Handler. This manipulation causes out-of-bounds write. This vulnerability is handled as CVE-2026-63638. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in AcademySoftwareFoundation OpenImageIO up to 3.0.20.9/3.1.15.9/3.2.0.2-beta1. It has been declared as critical. Affected by this vulnerability is the function CineonInput::open of the file src/cineon.imageio/cineoninput.cpp of the component Cineon Image Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open() maps it to a 32-bit imagespec, but libcineon maps the unsupported depth to an 8-byte value, so cineoninput::read_native_scanline() causes attacker-controlled data to be written beyond the 4-byte-per-pixel caller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/cineon.imageio/cineoninput.cpp, CineonInput::open(), CineonInput::read_native_scanline(), ComponentDataSize(), bit depth 26, and ImageSpec, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-63638 since 07/17/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 3.0.21.0, 3.1.16.0 or 3.2.0.3-beta1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenImageIO

Version

• 3.0.20.0
• 3.0.20.1
• 3.0.20.2
• 3.0.20.3
• 3.0.20.4
• 3.0.20.5
• 3.0.20.6
• 3.0.20.7
• 3.0.20.8
• 3.0.20.9
• 3.1.15.0
• 3.1.15.1
• 3.1.15.2
• 3.1.15.3
• 3.1.15.4
• 3.1.15.5
• 3.1.15.6
• 3.1.15.7
• 3.1.15.8
• 3.1.15.9
• 3.2.0.2-beta1

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/OpenImageIO/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion