OpenImageIO EUVD-2026-30417

Exploitation requires the following specific conditions: (1) OpenImageIO version prior to 3.0.18.0 or 3.1.13.0 must be in use; (2) the attacker-controlled TGA image file must be processed by the TGAInput decoder, meaning it must be a valid TGA file format; (3) the TGA file must use indexed/palette color mode (palette data must be present in the file); (4) the palette index offset k must equal exactly 0xFFFFFFFC in the decoder context; (5) palbytespp (palette bytes per pixel) must equal 4; (6) a local user must open or load the malicious TGA file, either directly or as part of automated batch processing. The vulnerability does NOT require network access, does NOT require elevated privileges, and does NOT require prior authentication to the system. However, the user interaction requirement (UI:R per CVSS) means the attack cannot be fully automated; an attacker must either social-engineer file opening or place the malicious TGA in a location where it will be opened during normal workflow. The vulnerability is specific to TGA format processing - other image formats supported by OpenImageIO are not affected.

This vulnerability presents moderate but specific real-world risk. CVSS score of 5.5 with local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R) accurately reflects the threat profile. The attack requires an end-user to manually open a specially crafted TGA image file, typically within VFX/animation software that uses OpenImageIO as its imaging backend. The impact is denial of service via segmentation fault - the application crashes when processing the malicious file. Exploitation probability (EPSS) cannot be assessed without score data, but the attack is deterministic once triggered: the integer overflow condition is mathematically guaranteed when the specific k and palbytespp values align. No active exploitation (KEV status unknown from input) or public exploit code (POC status unknown) is confirmed. The vulnerability is not remotely exploitable and requires no authentication, but the UI:R requirement significantly limits attack surface compared to automated exploitation. For VFX studios or animation teams using OpenImageIO, the risk is primarily supply-chain based: a malicious TGA file embedded in project assets could be opened by unknowing users, causing work interruption. Patching is straightforward and addresses a clear integer arithmetic flaw with no known workarounds.

A VFX artist receives a project archive containing image assets from an external collaborator. The archive includes a specially crafted TGA file with a malicious palette index (k = 0xFFFFFFFC) and palette entry size of 4 bytes. When the artist opens the project in their VFX software (which uses OpenImageIO to load images), the application automatically loads the TGA file. The TGAInput decoder triggers the integer overflow, wraps the bounds check, and attempts to read palette data 4 GB beyond the buffer, causing a segmentation fault that crashes the application and potentially interrupts production work.