CVE-2026-63638

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.21.0 OpenImageIO versions prior to 3.1.16.0 OpenImageIO versions prior to 3.2.0.3-beta1

Description A heap out-of-bounds write and memory corruption occur when processing a crafted Cineon image that declares an unsupported component bit depth of 26. The CineonInput::open() function maps this to a 32-bit ImageSpec, but libcineon maps the unsupported depth to an 8-byte value. Consequently, the CineonInput::read native scanline() function writes attacker-controlled data beyond the 4-byte-per-pixel caller buffer. The issue is located in src/cineon.imageio/cineoninput.cpp and involves the ComponentDataSize() function.

Recommendations Update to version 3.0.21.0. Update to version 3.1.16.0. Update to version 3.2.0.3-beta1.