Log in Start free

Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M

CVE-2026-63422OpenImageIO OpenEXR plugin partial edge tile heap out-of-bounds write

High 7.8

In plain English

A high-severity heap buffer overflow in OpenImageIO from AcademySoftwareFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 89.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads a partial edge-tile rectangle. openexrinput::read_native_tiles() copies each row into the caller buffer using the padded whole-tile scanline_stride rather than user_scanline_bytes for the requested rectangle, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/openexr.imageio/exrinput.cpp, OpenEXRInput::read_native_tiles(), partial edge tile, user_scanline_bytes, and scanline_stride, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12openimageiono fix listedDEBIAN-CVE-2026-63422
Debian:13openimageiono fix listedDEBIAN-CVE-2026-63422
Debian:14openimageio3.1.18.0+dfsg-2DEBIAN-CVE-2026-63422
Ubuntu:22.04:LTSopenimageiono fix listedUBUNTU-CVE-2026-63422
Ubuntu:26.10openimageiono fix listedUBUNTU-CVE-2026-63422

Affected products (as reported)

VendorProductVersions
AcademySoftwareFoundation OpenImageIO < 3.0.21.0>= 3.1.0.0, < 3.1.16.0>= 3.2.0.0-dev, < 3.2.0.3-beta1

Weakness: CWE-122, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References