{"id":"CVE-2026-63419","summary":"OpenImageIO: IFF ZBUFFER tile read writes past caller tile buffer","details":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel size. iffinput::read_native_tile() copies according to m_header.pixel_bytes() rather than imagespec::tile_bytes(true), and a failed read can leave m_buf nonempty so a later call copies partially initialized data into the undersized caller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/iff.imageio/iffinput.cpp, IffInput::read_native_tile(), ImageSpec::tile_bytes(true), m_header.pixel_bytes(), ZBUFFER, and m_buf, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.","aliases":["GHSA-w6wc-gcf4-5pj2"],"modified":"2026-09-20T14:13:50.130854Z","published":"2026-09-18T15:46:44.678Z","related":["openSUSE-SU-2026:11442-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63419.json"},"references":[{"type":"WEB","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.21.0"},{"type":"WEB","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0"},{"type":"ADVISORY","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-w6wc-gcf4-5pj2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63419.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63419"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/9cda48b150294c7f024e680a6c9b0402e50f4816"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5268"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/academysoftwarefoundation/openimageio","events":[{"introduced":"0"},{"introduced":"a0940a9f1e4a8ff20edc9d550a4dea4723d1aa58"},{"fixed":"710eeafcf7cd75fbfd5e34387ee4c373aa875356"},{"fixed":"f3f12ab761fbccaa644937780e7246674033c407"},{"fixed":"45414c1aedcd3cc98244b4c5802ec53e91976f70"},{"fixed":"9cda48b150294c7f024e680a6c9b0402e50f4816"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.0.21.0"},{"introduced":"3.1.0.0"},{"fixed":"3.1.16.0"},{"introduced":"3.2.0.0-dev"},{"fixed":"3.2.0.3-beta1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v3.1.15.0","v3.0.20.0","v3.0.19.1","v3.1.14.1","v3.1.14.0","v3.0.19.0","v3.0.18.1","v3.1.13.1","v3.2.0.2-dev","v3.1.13.0","v3.0.18.0","v3.1.12.0","v3.0.17.0","v3.1.11.0","v3.0.16.0","v3.2.0.0-dev","v3.1.10.0","v3.0.15.0","v3.0.14.0","v3.1.9.0","v3.0.13.0","v3.1.8.0","v3.0.12.0","v3.1.7.0","v3.0.11.0","v3.1.6.2","v3.1.6.1","v3.1.6.0-rc1","v3.1.5.0-beta2","v3.0.10.1","v3.0.10.0","v3.1.4.0-beta","v3.0.9.0","v3.0.8.1","v3.0.8.0","v3.0.7.0","v3.0.6.1","v3.0.6.0","v3.0.5.0","v3.0.4.0","v3.0.3.1","v3.0.3.0","v3.0.2.0","v3.0.1.0","v3.0.0.3","v3.0.0.2-RC1","v3.0.0.1-beta2","v3.0.0.0-beta1","v2.6.5.0-dev","v2.6.2.0-dev","v2.6.1.0-dev","v2.5.2.0-dev","v2.5.0.0-dev","v2.4.2.2-dev","v2.4.2.1-dev","v2.4.2.0-dev","v2.4.1.1-dev","v2.4.0.3-dev","v2.4.0.2-dev","v2.4.0.1-dev","v2.4.0.0-dev","v2.3.6.0-dev","v2.3.5.0-dev","Release-2.3.4.0-dev","Release-2.3.3.0-dev","Release-2.3.2.0-dev","Release-2.3.1.0-dev","Release-2.3.0.0-dev","Release-2.2.3.0-dev","Release-2.2.2.0-dev","Release-2.2.1.1-dev","Release-2.2.1.0-dev","Release-2.2.0.0-dev","Release-2.1.8.0-RC1","Release-2.1.7-beta","Release-2.1.5.0-dev","Release-2.1.4.0-dev","Release-2.1.3-dev","spi-spcomp2-release-49.1","spi-Arn3.7.42.0","Release-2.1.2-dev","Release-2.1.1-dev","Release-2.1.0-dev","spi-spcomp2-release-48.0","spi-Arn3.7.25.0","spi-spcomp2-release-47.0","spi-Arn3.7.23.3","Release-2.0.1-RC1","Release-2.0.0-beta1","spi-spcomp2-release-45.4","spi-spcomp2-release-45.3","spi-spcomp2-release-45.1","spi-spcomp2-release-45.0","Release-1.9.4dev","Release-1.9.3dev","Release-1.9.2dev","spiArn-3.6.86.0","spi-spcomp2-release-44.2","spiArn-3.6.94.0","spi-spcomp2-release-44.1","spi-spcomp2-release-44.0","spiArn-3.6.84.0","spiArn-3.6.74.0","spi-Arn3.6.72.1","Release-1.9.1dev","spi-Arn3.6.69.3","spi-spcomp2-release-43.0","spi-Arn3.6.64.6","Release-1.8.4dev","spi-spcomp2-release-42.0-rhel7","spi-Arn3.6.36.0","Release-1.8.3dev","Release-1.8.2dev","spi-Arn3.6.33.4","spi-Arn3.6.27.0","Release-1.8.1dev","spi-Arn3.6.21.3","spi-Arn3.6.18.0","Release-1.8.0dev","spi-spcomp2-release-41.0","Release-1.7.6RC1","spi-Arn3.6.7.1","Release-1.7.5beta","Release-1.7.4dev","Release-1.7.3dev","spi-Arn3.5.93.10","spi-Arn3.5.91.0","Release-1.7.2dev","spi-Arn3.5.90.0","spiArn3.5.82.0","Release-1.7.1dev","Release-1.7.0dev","spiArn3.5.75.0","spi-spcomp2-release-39.1","Release-1.6.6beta","spiArn3.5.68.0","spi-spcomp2-release-38.0","spiArn3.5.66.0","spi-Arn3.5.82.0","spi-Arn3.5.75.0","spi-Arn3.5.68.0","spi-Arn3.5.66.0","spi-Arn3.4.72.0","spi-Arn3.4.71.0","Release-1.6.4dev","spiArn3.5.50.0","spi-Arn3.5.50.0","Release-1.6.3dev","spiArn3.5.48.0","spi-Arn3.5.48.0","spiArn3.5.45.1","spiArn3.5.45.0","spi-Arn3.5.45.1","spi-Arn3.5.45.0","spi-Arn3.5.41.0","Release-1.6.2dev","spi-Arn3.5.37.0","spi-Arn3.5.35.0","Release-1.6.1dev","spi-Arn3.5.31.0","spi-Arn3.5.28.0","spi-Arn3.5.26.0","spi-Arn3.5.25.0","Release-1.5.7dev","spi-Arn3.5.24.0","Release-1.5.6dev","Release-1.5.5dev","spi-Arn3.5.16.0","spi-Arn3.5.14.0","Release-1.5.4dev-pre-SIMD","spi-Arn3.5.13.1","Release-1.5.3dev","spi-Arn3.5.12.0","Release-1.5.2dev","spi-Arn3.5.11.0","spi-Arn3.5.10.0","Release-1.5.1dev","spi-Arn3.5.8.0","Release-1.5.0dev","spi-Arn3.5.5.0","Release-1.4.6RC1","spi-Arn3.5.2.0","Release-1.4.5dev","spi-Arn3.5.0.0","spi-Arn3.4.73.7","Release-1.4.4dev","Release-1.4.3dev","spi-v8-Arn3.4.73.6","spi-Arn3.4.73.6","Release-1.4.2dev","spi-v7-Arn3.4.73.3","Release-1.4.1dev","Release-1.3.6-dev","Arnold-3.4.72.0","arnold-3.4.71.0","Release-1.3.5-dev","Release-1.3.5","Release-1.3.4-dev","Release-1.3.3-dev","Release-1.3.2-dev","Release-1.3.1-dev","Release-1.3.0-dev","Release-1.1.1","Release-1.1.0","Release-1.1.0-beta4","Release-1.1.0-beta3","Release-1.1.0-beta2","Release-1.1.0-beta1","Release-1.0.1","Release-1.0.0","Release-0.10.0","spi-SpComp2-v20","spi-SpComp2-v9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63419.json","vanir_signatures_modified":"2026-09-20T14:13:50Z","vanir_signatures":[{"deprecated":false,"digest":{"length":1214,"function_hash":"88757115461202315318196602174383292768"},"id":"CVE-2026-63419-0fc5882c","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/9cda48b150294c7f024e680a6c9b0402e50f4816","target":{"file":"src/iff.imageio/iffinput.cpp","function":"IffInput::read_native_tile"}},{"deprecated":false,"digest":{"function_hash":"29045872209946506225918996446286422010","length":8341},"id":"CVE-2026-63419-289e27dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/9cda48b150294c7f024e680a6c9b0402e50f4816","target":{"file":"src/iff.imageio/iffinput.cpp","function":"IffInput::readimg"}},{"source":"https://github.com/academysoftwarefoundation/openimageio/commit/9cda48b150294c7f024e680a6c9b0402e50f4816","target":{"file":"src/iff.imageio/iffinput.cpp","function":"IffInput::read_header"},"deprecated":false,"digest":{"function_hash":"219406730860939334578501043291006583210","length":3433},"id":"CVE-2026-63419-48d6dba8","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/9cda48b150294c7f024e680a6c9b0402e50f4816","target":{"file":"src/iff.imageio/iffinput.cpp"},"deprecated":false,"digest":{"line_hashes":["231408868653658965145330111104374330557","126149012185818063414304901304493943297","174981944368785305007623253146507035661","24529556265312807417231131959547324320","276766773435303500123312172629225621842","224269838773370672208241011997987290431","101660242689996276116420148285163626751","166262942741298452805167427878782058109","303585414278644843679998744087859191575","245766159732156439594108875440991351471","1998538216384101068762482251012175621","178867381775679728133076588279687161122","269716569626761411373191145889129808355","207207435472122517857803365598114845759","226695295619793764660875647149924714795","275421393983800324113406243757613924690","231533422352333542196451739312692457583","245653017364600163929819606910749933861","144383331229573945519684888715770458114","327739065756562959767261424637923567084","144480370892562577405973630375882975447","256449329096214087787842847719193232780","29836936532392816402763032038568197926","338162734889080174143202722324274343512","263282312155382506130997503448399744995","57191996358774629113910948407135510552","325447892281044241871491437853263912391","35682302227369159973652299602927026185","124591789874827246929740752614319733292","78145417691388889025349996653532448355","325425347544071119660492536381888737844","231521978081826881745195757623931788084","95505720400841188309831956937247543814","213572097174086057751938751734931106963","16638566162120960357142903065018849033","301240003579576823459803686034736585167","110240929531806917041548244490193544692","39845696267265541470275519679673851164","38555973702188469438815335566414557705","118625816763785597603682098311351764034","60309556602545377407251717033119866159","181096196127922574290505820635084904524","115982874918476305586589389026585188790","80731672105255479307615679020448838035","155902665931990013490548331869401651311"],"threshold":0.9},"id":"CVE-2026-63419-92d44adf"},{"deprecated":false,"digest":{"function_hash":"121785538538014264161816718266193059820","length":108},"id":"CVE-2026-63419-f17ad5e0","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openimageio/commit/9cda48b150294c7f024e680a6c9b0402e50f4816","target":{"function":"read_chunk","file":"src/iff.imageio/iffinput.cpp"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}