Hi,
The following vulnerabilities were published for openimageio.
CVE-2026-65969[0]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can
| leave a pending gif frame that is processed during output close.
| gifsplitpalette() computes numpixels multiplied by the palette
| partition width in signed 32-bit arithmetic; a large image overflows
| that intermediate, corrupts subpixelsa, and drives an out-of-bounds
| read while building the gif palette, resulting in a process crash
| and denial of service. The affected implementation is identified by
| src/gif.imageio/gif.h, GifSplitPalette(), numPixels, subPixelsA,
| GIFOutput, and truncated TGA input, which define the relevant source
| path, functions, state, and trigger. This issue is fixed in versions
| 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9mwc-fjgj-8wmq
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5292
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/134977da625a84fc5a09a34321806f1fe0093c24 (v3.2.0.3-beta1)
CVE-2026-63638[1]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon
| image can declare unsupported component bit depth 26.
| cineoninput::open() maps it to a 32-bit imagespec, but libcineon
| maps the unsupported depth to an 8-byte value, so
| cineoninput::read_native_scanline() causes attacker-controlled data
| to be written beyond the 4-byte-per-pixel caller buffer, resulting
| in a heap out-of-bounds write and memory corruption. The affected
| implementation is identified by src/cineon.imageio/cineoninput.cpp,
| CineonInput::open(), CineonInput::read_native_scanline(),
| ComponentDataSize(), bit depth 26, and ImageSpec, which define the
| relevant source path, functions, state, and trigger. This issue is
| fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9hxv-jvgr-3x8g
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5283
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/6f2b2e85b3b3933ccc5a46303d5535f99bfa39fb (v3.2.0.3-beta1)
CVE-2026-63635[2]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with
| an invalid color_mode bypasses normal validation when oiio:rawcolor
| or psd:rawdata is enabled. psdinput::setup() then uses the attacker-
| controlled value to index fixed color-mode tables, causing a global
| out-of-bounds read and potentially a bogus allocation, resulting in
| denial of service. The affected implementation is identified by
| src/psd.imageio/psdinput.cpp, PSDInput::validate_header(),
| PSDInput::setup(), oiio:RawColor, psd:RawData, color_mode, and
| mode_channel_count, which define the relevant source path,
| functions, state, and trigger. This issue is fixed in versions
| 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3c8w-9xvm-r6gf
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5282
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/50481b0f90932a4675f65f3cc26407139cb9e20e (v3.2.0.3-beta1)
CVE-2026-63422[3]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled
| openexr image whose width is not a multiple of its tile width can
| trigger an overflow when a caller reads a partial edge-tile
| rectangle. openexrinput::read_native_tiles() copies each row into
| the caller buffer using the padded whole-tile scanline_stride rather
| than user_scanline_bytes for the requested rectangle, resulting in a
| heap out-of-bounds write and memory corruption. The affected
| implementation is identified by src/openexr.imageio/exrinput.cpp,
| OpenEXRInput::read_native_tiles(), partial edge tile,
| user_scanline_bytes, and scanline_stride, which define the relevant
| source path, functions, state, and trigger. This issue is fixed in
| versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh5r-whph-qmc5
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5295
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/7303134f13b0f9dc738b8ecabecd8c9f90cbd4c9 (v3.2.0.3-beta1)
CVE-2026-63420[4]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with
| transparency metadata creates fewer stored channel_buffers than the
| spec.nchannels value advertised by the rawcolor path. when
| oiio:rawcolor or psd:rawdata is enabled,
| psdinput::read_native_scanline() passes spec.nchannels to
| psdinput::interleave_row(), which indexes beyond channel_buffers,
| resulting in a heap out-of-bounds read and process crash. The
| affected implementation is identified by
| src/psd.imageio/psdinput.cpp, PSDInput::read_native_scanline(),
| PSDInput::interleave_row(), oiio:RawColor, psd:RawData,
| channel_buffers, and spec.nchannels, which define the relevant
| source path, functions, state, and trigger. This issue is fixed in
| versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5307
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/4995b25b8216552630e0aee0d8870e0d3aaae7ee (v3.2.0.3-beta1)
CVE-2026-63419[5]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled
| iff is exposed with a 16-bit public imagespec while the decoder
| retains a 32-bit internal pixel size. iffinput::read_native_tile()
| copies according to m_header.pixel_bytes() rather than
| imagespec::tile_bytes(true), and a failed read can leave m_buf
| nonempty so a later call copies partially initialized data into the
| undersized caller buffer, resulting in a heap out-of-bounds write
| and memory corruption. The affected implementation is identified by
| src/iff.imageio/iffinput.cpp, IffInput::read_native_tile(),
| ImageSpec::tile_bytes(true), m_header.pixel_bytes(), ZBUFFER, and
| m_buf, which define the relevant source path, functions, state, and
| trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and
| 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-w6wc-gcf4-5pj2
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5268
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/9cda48b150294c7f024e680a6c9b0402e50f4816 (v3.2.0.3-beta1)
CVE-2026-59956[6]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, An uncompressed
| 16-bit iff image with a z-buffer makes iffinput::readimg() allocate
| a temporary scanline from m_header.rgba_count but copy from it using
| m_header.pixel_bytes(), whose stride also includes z-buffer bytes.
| the oversized memcpy reads beyond the temporary heap buffer and
| copies adjacent memory into the output image, resulting in a crash
| or disclosure of adjacent heap data. The affected implementation is
| identified by src/iff.imageio/iffinput.cpp, IffInput::readimg(),
| m_header.rgba_count, and m_header.pixel_bytes(), which define the
| relevant source path, functions, state, and trigger. This issue is
| fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-hjfv-gvxc-qgvh
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5251
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/f01bd16764b2a06f372899e3e302280a7f9c8c02 (v3.2.0.3-beta1)
CVE-2026-59181[7]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted cineon
| file can supply a numberofelements value greater than the format
| maximum of eight. cineoninput::open() uses that unchecked value as
| the loop bound while filling the fixed strings[8] array, writing
| pointers beyond the stack buffer and into adjacent state, resulting
| in memory corruption and denial of service. The affected
| implementation is identified by src/cineon.imageio/cineoninput.cpp,
| CineonInput::open(), numberOfElements, and strings[8], which define
| the relevant source path, functions, state, and trigger. This issue
| is fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh8r-vmqq-56pp
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5250
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/908f22f5528e88e5e96184c194caa26b54b2b85f (v3.2.0.3-beta1)
CVE-2026-59156[8]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits
| stream containing consecutive 2880-byte header blocks without the
| mandatory end keyword makes fitsinput::read_fits_header() call
| itself without a depth bound. repeated recursive parsing exhausts
| the application stack, resulting in denial of service. The affected
| implementation is identified by src/fits.imageio/fitsinput.cpp,
| FitsInput::read_fits_header(), END keyword, and 2880-byte FITS
| header blocks, which define the relevant source path, functions,
| state, and trigger. This issue is fixed in versions 3.0.20.0,
| 3.1.15.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xvwr-x6ch-v2fq
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5248
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/b0de7d40d06eb4abc7ef14c1321a1a2a976d8c1c (v3.2.0.3-beta1)
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-65969
https://www.cve.org/CVERecord?id=CVE-2026-65969
[1] https://security-tracker.debian.org/tracker/CVE-2026-63638
https://www.cve.org/CVERecord?id=CVE-2026-63638
[2] https://security-tracker.debian.org/tracker/CVE-2026-63635
https://www.cve.org/CVERecord?id=CVE-2026-63635
[3] https://security-tracker.debian.org/tracker/CVE-2026-63422
https://www.cve.org/CVERecord?id=CVE-2026-63422
[4] https://security-tracker.debian.org/tracker/CVE-2026-63420
https://www.cve.org/CVERecord?id=CVE-2026-63420
[5] https://security-tracker.debian.org/tracker/CVE-2026-63419
https://www.cve.org/CVERecord?id=CVE-2026-63419
[6] https://security-tracker.debian.org/tracker/CVE-2026-59956
https://www.cve.org/CVERecord?id=CVE-2026-59956
[7] https://security-tracker.debian.org/tracker/CVE-2026-59181
https://www.cve.org/CVERecord?id=CVE-2026-59181
[8] https://security-tracker.debian.org/tracker/CVE-2026-59156
https://www.cve.org/CVERecord?id=CVE-2026-59156
Please adjust the affected versions in the BTS as needed.