EUVD-2026-83123Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local crafted-file read (AV:L/UI:R), no auth needed (PR:N); OOB read only crashes the process, so C:N/I:N/A:H, matching the vendor; rawcolor/rawdata precondition is config, not complexity.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. when oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers, resulting in a heap out-of-bounds read and process crash. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::read_native_scanline(), PSDInput::interleave_row(), oiio:RawColor, psd:RawData, channel_buffers, and spec.nchannels, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
AnalysisAI
A heap out-of-bounds read in the OpenImageIO PSD reader can crash any application that processes a crafted indexed Photoshop (PSD) file while the non-default oiio:rawcolor or psd:rawdata option is enabled. The flaw affects OpenImageIO builds prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, where a PSD whose transparency metadata yields fewer stored channel buffers than the advertised channel count causes PSDInput::interleave_row() to read past the end of channel_buffers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the non-default oiio:rawcolor OR psd:rawdata option to be enabled in the OpenImageIO reader, and (2) the victim to open/process an attacker-crafted indexed PSD file whose transparency metadata produces fewer stored channel_buffers than the advertised spec.nchannels. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-priority availability issue, not a widespread threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to OpenImageIO 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 (or later), which make interleave_row() validate buffer sizes and return false on corrupt PSD channel data rather than reading out of bounds; see the advisory https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j, PR https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5307 and commit https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/4995b25b8216552630e0aee0d8870e0d3aaae7ee. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openimageio
View allBuffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and caus
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.
An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Proje
A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. Ra
A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branc
A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. Rated
A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.
An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today