CVE-2026-63420

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.21.0 OpenImageIO versions prior to 3.1.16.0 OpenImageIO versions prior to 3.2.0.3-beta1

Description An issue exists when processing indexed PSD files with transparency metadata. When oiio:rawcolor or psd:rawdata is enabled, the software creates fewer stored channel buffers than the spec.nchannels value advertised. Consequently, the PSDInput::read native scanline() function passes spec.nchannels to PSDInput::interleave row(), which indexes beyond the channel buffers, leading to a heap out-of-bounds read and a process crash.

Recommendations Update to version 3.0.21.0. Update to version 3.1.16.0. Update to version 3.2.0.3-beta1.