CVE-2026-65969

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.21.0 OpenImageIO versions prior to 3.1.16.0 OpenImageIO versions prior to 3.2.0.3-beta1

Description A truncated TGA file can leave a pending GIF frame that is processed during output close. The gifsplitpalette() function calculates the product of numPixels and the palette partition width using signed 32-bit arithmetic. A large image can cause an integer overflow in this intermediate calculation, which corrupts subPixelsA and leads to an out-of-bounds read while building the GIF palette. This results in a process crash and denial of service. The issue is located in src/gif.imageio/gif.h and involves the GifSplitPalette() function, numPixels and subPixelsA variables, and the GIFOutput state.

Recommendations Update to version 3.0.21.0. Update to version 3.1.16.0. Update to version 3.2.0.3-beta1.