OpenImageIO EUVD-2026-83130

Exploitation requires that the target application process an attacker-supplied Maya IFF (.iff) image through OpenImageIO's iff.imageio reader. The specific trigger is a zbuffer-only tiled IFF whose ZBUFFER (Z-depth) data is exposed via a 16-bit public ImageSpec while the internal pixel size remains 32-bit, OR an IFF whose read fails after partially resizing m_buf so a later read_native_tile() call copies from a half-initialized buffer; in both cases read_native_tile() sizes the copy by m_header.pixel_bytes() rather than ImageSpec::tile_bytes(true). Limiting factors: the vector is local (AV:L) and requires user interaction / file ingestion (UI:R) - the attacker cannot trigger it remotely without the victim opening the crafted file - and affected versions are those prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. Risk is amplified in automated render/asset pipelines where untrusted IFF files are batch-processed without a human explicitly opening each file.

This is a genuine memory-corruption bug (CWE-787 heap out-of-bounds write) in OpenImageIO's Maya IFF decoder, but the practical risk is bounded by the local, victim-triggered attack surface. The vendor CVSS3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) is internally consistent with the root cause: exploitation requires the victim to open/process a crafted IFF file (AV:L + UI:R), no prior authentication is needed (PR:N), and a successful heap OOB write plausibly yields full C:H/I:H/A:H via memory corruption. There is no EPSS score, no CISA KEV listing, and no public exploit provided in the intelligence - status is 'no public exploit identified at time of analysis'. Weighing signals: the high CVSS is driven by the memory-corruption impact triple, not by ease of remote mass-exploitation; because the vector is local and interaction-dependent, this is a patch-in-normal-cycle issue for most consumers rather than an emergency, EXCEPT in automated VFX/render-farm pipelines that ingest untrusted IFF assets, where 'user interaction' collapses to routine batch processing and the effective exposure is higher. No signals conflict; the main caveat is that C:H/I:H/A:H assumes the OOB write is controllably weaponizable to code execution, which the advisory does not independently demonstrate.

An attacker crafts a malicious Maya IFF image - either a ZBUFFER-only (Z-depth) file exposed with a 16-bit ImageSpec while the decoder keeps a 32-bit internal pixel size, or a file that induces a failed read leaving m_buf non-empty - and delivers it to a target that uses OpenImageIO (e.g. a texture/asset in a VFX pipeline or a DCC tool). When the victim or an automated pipeline opens the file, IffInput::read_native_tile() copies using m_header.pixel_bytes() instead of ImageSpec::tile_bytes(true), writing partially initialized data past the undersized caller tile buffer and corrupting the heap. No public exploit code was identified in the provided intelligence.