CVE-2026-63419

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.21.0 OpenImageIO versions prior to 3.1.16.0 OpenImageIO versions prior to 3.2.0.3-beta1

Description A heap out-of-bounds write and memory corruption occur when processing a zbuffer-only tiled iff file. This happens because a 16-bit public imagespec is exposed while the decoder maintains a 32-bit internal pixel size. The function read native tile() copies data based on m header.pixel bytes() instead of imagespec::tile bytes(true). If a read operation fails, the m buf variable may remain non-empty, causing subsequent calls to copy partially initialized data into an undersized caller buffer. The issue is located in src/iff.imageio/iffinput.cpp and involves the IffInput::read native tile() and ImageSpec::tile bytes(true) functions, as well as the m header.pixel bytes(), ZBUFFER, and m buf components.

Recommendations Update to version 3.0.21.0. Update to version 3.1.16.0. Update to version 3.2.0.3-beta1.