OpenImageIO CVE-2026-63638

Requires the target application to open and parse an attacker-supplied Cineon (.cin) image via OpenImageIO's cineon.imageio reader on an affected version prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1. The specific trigger is a Cineon file declaring an unsupported component bit depth (e.g. 26) that CineonInput::open() maps to a 32-bit ImageSpec while libcineon's ComponentDataSize returns an 8-byte size. Limiting factors: exploitation needs user/processing interaction (UI:R) - a victim or automated pipeline must actually decode the crafted file - and depends on the deployment ingesting untrusted Cineon input; environments that never process external .cin files are effectively unexposed. No authentication is required against the parsing process itself (PR:N).

The vendor CVSS3.1 score is 8.3 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H. The network vector is realistic in the sense that malicious Cineon (.cin) files are delivered over the network (asset pipelines, downloads, render-farm ingestion), but exploitation is NOT service-facing remote code execution against a listening daemon - it requires a victim application to open/parse the crafted file, which is why UI:R (user/processing interaction) is correctly set. This is a classic file-format parser memory-corruption bug (CWE-787 heap out-of-bounds write): a crafted Cineon image declares an unsupported component bit depth of 26, CineonInput::open() maps it to a 32-bit ImageSpec while libcineon's ComponentDataSize maps it to an 8-byte value, so read_native_scanline() writes attacker-controlled data past the 4-byte-per-pixel buffer. No EPSS score, no CISA KEV listing, and no public exploit (POC) are present in the supplied intelligence; therefore this is 'no public exploit identified at time of analysis.' The I:H/A:H rating reflects that heap corruption can plausibly lead to code execution or crash, but the input contains no evidence of a working control-flow-hijack exploit - the confirmed observable behavior in the vendor's own test harness is an assert/abort (DoS). Net: a genuinely serious memory-safety flaw worth patching promptly in any pipeline that ingests untrusted Cineon files, but there is no signal of active or automatable mass exploitation, so it is a patch-in-normal-cycle priority rather than an emergency, especially for environments that never process externally-sourced .cin files.

An attacker crafts a malicious Cineon (.cin) file whose header declares an unsupported per-channel bit depth of 26 and delivers it into a VFX/animation asset pipeline, render farm, or image-conversion service that uses OpenImageIO. When the target application opens the file, CineonInput::read_native_scanline() writes attacker-controlled bytes beyond the allocated 4-byte-per-pixel buffer, corrupting the heap. No public exploit code is identified; the vendor regression test demonstrates the trigger causing an abort/error, with memory corruption as the underlying primitive.