OpenImageIO EUVD-2026-83123

Exploitation requires (1) the non-default oiio:rawcolor OR psd:rawdata option to be enabled in the OpenImageIO reader, and (2) the victim to open/process an attacker-crafted indexed PSD file whose transparency metadata produces fewer stored channel_buffers than the advertised spec.nchannels. Limiting factors: attack vector is local (AV:L) with required user interaction (UI:R - the victim must supply the file), and the rawcolor/rawdata path is not the default configuration, so systems using standard color-managed reads are not affected. Impact is confined to a crash of the processing application (A:H); no code execution or data disclosure is claimed.

This is a genuine but low-priority availability issue, not a widespread threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scores 5.5 (Medium): local attack vector, requiring the victim to open a crafted PSD file (UI:R), with impact limited to a process crash (A:H) - the vendor explicitly rates confidentiality and integrity as None despite this being an out-of-bounds READ. There is no EPSS score, no CISA KEV listing, and no public exploit code provided (only a regression test file, crash-rowbounds-f999.psd, ships with the fix). CWE-125 (out-of-bounds read) is consistent with the description. NOTE A KEY CAVEAT: exploitation requires the non-default oiio:rawcolor or psd:rawdata option to be enabled - this is a real limiting condition not captured by the AC:L rating, and it materially reduces real-world exposure. The 'Information Disclosure' tag conflicts with the vendor's C:N rating; the observable effect is a crash, not data leakage. Overall: a real memory-safety bug worth patching in image pipelines but far from an urgent, remotely-weaponizable priority.

An attacker crafts a malicious indexed PSD file whose transparency metadata causes fewer channel_buffers to be allocated than spec.nchannels advertises, then delivers it to a victim who processes it with OpenImageIO in an application or workflow configured with oiio:rawcolor or psd:rawdata enabled. When the file is read, PSDInput::interleave_row() indexes past channel_buffers, triggering a heap out-of-bounds read and crashing the process. No public exploit code exists, though a proof-of-concept crash file is included in the project's regression test suite.