AcademySoftwareFoundation OpenImageIO prior 3.0.21.0/3.1.16.0/3.2.0.3-beta1 Gif Split Palette imageio/gif.h GifSplitPalette out-of-bounds

Summaryinfo

A vulnerability was found in AcademySoftwareFoundation OpenImageIO. It has been declared as problematic. Affected by this vulnerability is the function GifSplitPalette of the file imageio/gif.h of the component Gif Split Palette. The manipulation results in out-of-bounds. This vulnerability is identified as CVE-2026-65969. The attack is only possible with local access. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in AcademySoftwareFoundation OpenImageIO. It has been classified as problematic. Affected is the function GifSplitPalette of the file imageio/gif.h of the component Gif Split Palette. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on availability. CVE summarizes:

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette() computes numpixels multiplied by the palette partition width in signed 32-bit arithmetic; a large image overflows that intermediate, corrupts subpixelsa, and drives an out-of-bounds read while building the gif palette, resulting in a process crash and denial of service. The affected implementation is identified by src/gif.imageio/gif.h, GifSplitPalette(), numPixels, subPixelsA, GIFOutput, and truncated TGA input, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-65969 since 07/23/2026. The exploitability is told to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 3.0.21.0, 3.1.16.0 or 3.2.0.3-beta1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenImageIO

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/OpenImageIO/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion