SB2026080208 - Multiple vulnerabilities in oiio

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080208

SB2026080208 - Multiple vulnerabilities in oiio

Published: August 2, 2026

Security Bulletin ID SB2026080208
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 38% Medium 63%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-65969)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the GifSplitPalette function when processing a malformed TGA image during conversion to GIF output. A remote attacker can supply a specially crafted TGA image to cause a denial of service.

User interaction is required to open or process the crafted image, and the vulnerable path is reached only when writing GIF output.


2) Heap-based buffer overflow (CVE-ID: CVE-2026-67549)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service and corrupt heap memory.

The vulnerability exists due to a heap-based buffer overflow in TIFFInput::bit_convert() when processing a crafted 1-bit CMYK TIFF file during hash computation. A remote attacker can supply a specially crafted TIFF file to cause a denial of service and corrupt heap memory.

User interaction is required to process the crafted TIFF file, such as via iinfo -hash or oiiotool --hash.


3) Expired pointer dereference (CVE-ID: CVE-2026-65970)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to expired pointer dereference in TIFFInput::read_native_scanlines when processing a crafted ZIP-compressed TIFF during multithreaded scanline reads. A remote attacker can supply a specially crafted TIFF file to cause a denial of service.

User interaction is required to open or process the crafted TIFF, and the crash requires pixel read or bulk scanline processing with TIFF multithreading enabled.


4) Out-of-bounds read (CVE-ID: CVE-2026-63635)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in PSDInput::setup() when parsing a crafted PSD file through the RawColor input path. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

Only applications that enable raw PSD color output with oiio:RawColor=1 or psd:RawData=1 are vulnerable.


5) Out-of-bounds write (CVE-ID: CVE-2026-63638)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to cause a heap out-of-bounds write.

The vulnerability exists due to out-of-bounds write in the Cineon reader when processing a crafted Cineon image with an invalid component bit depth. A remote attacker can supply a specially crafted Cineon file to cause a heap out-of-bounds write.

User interaction is required to open or process a crafted Cineon file.


6) Out-of-bounds read (CVE-ID: CVE-2026-63420)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in `interleave_row` when parsing a crafted indexed PSD file with transparency metadata in raw PSD color output mode. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open the crafted PSD file, and exploitation requires `oiio:RawColor=1` or `psd:RawData=1`.


7) Heap-based buffer overflow (CVE-ID: CVE-2026-63422)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in OpenEXRInput::read_native_tiles() when parsing a crafted tiled OpenEXR image through the ImageInput::read_native_tiles() API. A remote attacker can trick the victim into processing a crafted image to execute arbitrary code.

User interaction is required to open or process a crafted tiled OpenEXR image. The issue is triggered when the requested tile range ends at the image boundary for a partial edge tile.


8) Out-of-bounds write (CVE-ID: CVE-2026-63419)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in IffInput::read_native_tile() when parsing a crafted Maya IFF file and copying tile data into a caller-provided buffer sized from ImageSpec::tile_bytes(true). A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.

User interaction is required to open a crafted file. The issue is reachable for ZBUFFER-only tiled images because the internal pixel size used for copying is larger than the public tile size exposed to callers, and a failed partial read can leave a buffer state that is reused by a later tile read.


Remediation

Install update from vendor's website.

References