CVE-2026-63635

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.21.0 OpenImageIO versions prior to 3.1.16.0 OpenImageIO versions prior to 3.2.0.3-beta1

Description A crafted PSD file containing an invalid color mode can bypass standard validation when oiio:rawcolor or psd:rawdata is enabled. The PSDInput::setup() function uses this attacker-controlled value to index fixed color-mode tables, leading to a global out-of-bounds read and potentially a bogus allocation, which can result in a denial of service. The issue is located in src/psd.imageio/psdinput.cpp and involves the PSDInput::validate header() and PSDInput::setup() functions, as well as the color mode and mode channel count variables.

Recommendations Update to version 3.0.21.0. Update to version 3.1.16.0. Update to version 3.2.0.3-beta1.