OpenImageIO CVE-2026-63635

Exploitation requires the application to have enabled the non-default OpenImageIO options oiio:RawColor or psd:RawData, because validate_header() only bypasses normal color-mode validation on this raw path (m_WantRaw short-circuit). The attacker must supply a crafted PSD file with an out-of-range color_mode value, and a victim or automated pipeline must open/process it (UI:R, local vector AV:L). Exploitation is limited to local file processing, requires user interaction, and does not affect deployments that leave the raw color/data options disabled (the default); maximum impact is a crash, with no confidentiality or integrity effect.

This is a genuine but low-priority denial-of-service issue, not a high-impact vulnerability. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 5.5 Medium) is internally consistent with the description: a local vector requiring a victim to open a crafted PSD file (UI:R), with pure availability impact (C:N/I:N/A:H) from a global out-of-bounds read and possible bogus allocation causing a crash. No EPSS score, no CISA KEV listing, and no public weaponized exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - though the fix PR ships a regression trigger file (bad_colormode.psd) that demonstrates the crash. The CWE-125 (out-of-bounds read) classification aligns with the described table-indexing over-read. A key limiting factor understated by raw CVSS: the flaw is only reachable when the non-default options oiio:RawColor or psd:RawData are enabled, because validate_header() short-circuits normal color-mode validation on the raw path. The 'Information Disclosure' tag conflicts with the vendor's C:N rating - impact is availability only, not disclosure. Overall: real, patched, but low real-world urgency given local-only vector, required user interaction, and non-default configuration gate.

An attacker crafts a malformed PSD file with an out-of-range color_mode value and delivers it to a victim (or an automated pipeline) that processes images with OpenImageIO configured with oiio:RawColor or psd:RawData enabled. When the file is opened, PSDInput::setup() uses the attacker-controlled color_mode to index fixed color-mode tables past their bounds, causing an out-of-bounds read and possible invalid allocation that crashes the process. No standalone exploit is public, but the fix includes a proof-of-concept PSD test file demonstrating the trigger.