EUVD-2026-83125Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local crafted-file vector with required victim interaction (AV:L/UI:R), no auth (PR:N), and crash-only impact (C:N/I:N/A:H); the raw-config gate is an app option, not attacker-controlled complexity.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value to index fixed color-mode tables, causing a global out-of-bounds read and potentially a bogus allocation, resulting in denial of service. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::validate_header(), PSDInput::setup(), oiio:RawColor, psd:RawData, color_mode, and mode_channel_count, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
AnalysisAI
Denial of service in OpenImageIO's PSD reader allows a crafted PSD file carrying an invalid color_mode value to index beyond the fixed color-mode tables, producing a global out-of-bounds read and potentially a bogus allocation that crashes the reading process. The exposure is narrow: the raw path is only reachable when the non-default oiio:RawColor or psd:RawData option is explicitly enabled, and an attacker must get a target application or automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5, CWE-125), so impact is availability-only with no confidentiality or integrity effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the application to have enabled the non-default OpenImageIO options oiio:RawColor or psd:RawData, because validate_header() only bypasses normal color-mode validation on this raw path (m_WantRaw short-circuit). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-priority denial-of-service issue, not a high-impact vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to OpenImageIO 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 (or later); the fix is carried in the tagged releases for each maintained branch and in commit 50481b0f90932a4675f65f3cc26407139cb9e20e from PR #5282, with details in advisory GHSA-3c8w-9xvm-r6gf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openimageio
View allBuffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and caus
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.
An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Proje
A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. Ra
A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branc
A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. Rated
A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.
An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today