CVE-2026-63419
- Source
- https://cve.org/CVERecord?id=CVE-2026-63419
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63419.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-63419
- Aliases
-
- GHSA-w6wc-gcf4-5pj2
- Downstream
- Related
- Published
- 2026-09-18T15:46:44Z
- Modified
- 2026-09-20T14:13:50Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- OpenImageIO: IFF ZBUFFER tile read writes past caller tile buffer
- Details
-
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel size. iffinput::read_native_tile() copies according to m_header.pixel_bytes() rather than imagespec::tile_bytes(true), and a failed read can leave m_buf nonempty so a later call copies partially initialized data into the undersized caller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/iff.imageio/iffinput.cpp, IffInput::read_native_tile(), ImageSpec::tile_bytes(true), m_header.pixel_bytes(), ZBUFFER, and m_buf, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-787" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63419.json" }- References
-
- https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.21.0
- https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0
- https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-w6wc-gcf4-5pj2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63419.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-63419
- https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/9cda48b150294c7f024e680a6c9b0402e50f4816
- https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5268
Affected packages
Git / github.com/academysoftwarefoundation/openimageio
Affected ranges
- Type
- GIT
- Repo
- https://github.com/academysoftwarefoundation/openimageio
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "3.0.21.0" }, { "introduced": "3.1.0.0" }, { "fixed": "3.1.16.0" }, { "introduced": "3.2.0.0-dev" }, { "fixed": "3.2.0.3-beta1" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
Arnold-3.*
Arnold-3.4.72.0
Release-0.*
Release-0.10.0
Release-1.*
Release-1.0.0
Release-1.0.1
Release-1.1.0
Release-1.1.0-beta1
Release-1.1.0-beta2
Release-1.1.0-beta3
Release-1.1.0-beta4
Release-1.1.1
Release-1.3.0-dev
Release-1.3.1-dev
Release-1.3.2-dev
Release-1.3.3-dev
Release-1.3.4-dev
Release-1.3.5
Release-1.3.5-dev
Release-1.3.6-dev
Release-1.4.1dev
Release-1.4.2dev
Release-1.4.3dev
Release-1.4.4dev
Release-1.4.5dev
Release-1.4.6RC1
Release-1.5.0dev
Release-1.5.1dev
Release-1.5.2dev
Release-1.5.3dev
Release-1.5.4dev-pre-SIMD
Release-1.5.5dev
Release-1.5.6dev
Release-1.5.7dev
Release-1.6.1dev
Release-1.6.2dev
Release-1.6.3dev
Release-1.6.4dev
Release-1.6.6beta
Release-1.7.0dev
Release-1.7.1dev
Release-1.7.2dev
Release-1.7.3dev
Release-1.7.4dev
Release-1.7.5beta
Release-1.7.6RC1
Release-1.8.0dev
Release-1.8.1dev
Release-1.8.2dev
Release-1.8.3dev
Release-1.8.4dev
Release-1.9.1dev
Release-1.9.2dev
Release-1.9.3dev
Release-1.9.4dev
Release-2.*
Release-2.0.0-beta1
Release-2.0.1-RC1
Release-2.1.0-dev
Release-2.1.1-dev
Release-2.1.2-dev
Release-2.1.3-dev
Release-2.1.4.0-dev
Release-2.1.5.0-dev
Release-2.1.7-beta
Release-2.1.8.0-RC1
Release-2.2.0.0-dev
Release-2.2.1.0-dev
Release-2.2.1.1-dev
Release-2.2.2.0-dev
Release-2.2.3.0-dev
Release-2.3.0.0-dev
Release-2.3.1.0-dev
Release-2.3.2.0-dev
Release-2.3.3.0-dev
Release-2.3.4.0-dev
arnold-3.*
arnold-3.4.71.0
spi-Arn3.*
spi-Arn3.4.71.0
spi-Arn3.4.72.0
spi-Arn3.4.73.6
spi-Arn3.4.73.7
spi-Arn3.5.0.0
spi-Arn3.5.10.0
spi-Arn3.5.11.0
spi-Arn3.5.12.0
spi-Arn3.5.13.1
spi-Arn3.5.14.0
spi-Arn3.5.16.0
spi-Arn3.5.2.0
spi-Arn3.5.24.0
spi-Arn3.5.25.0
spi-Arn3.5.26.0
spi-Arn3.5.28.0
spi-Arn3.5.31.0
spi-Arn3.5.35.0
spi-Arn3.5.37.0
spi-Arn3.5.41.0
spi-Arn3.5.45.0
spi-Arn3.5.45.1
spi-Arn3.5.48.0
spi-Arn3.5.5.0
spi-Arn3.5.50.0
spi-Arn3.5.66.0
spi-Arn3.5.68.0
spi-Arn3.5.75.0
spi-Arn3.5.8.0
spi-Arn3.5.82.0
spi-Arn3.5.90.0
spi-Arn3.5.91.0
spi-Arn3.5.93.10
spi-Arn3.6.18.0
spi-Arn3.6.21.3
spi-Arn3.6.27.0
spi-Arn3.6.33.4
spi-Arn3.6.36.0
spi-Arn3.6.64.6
spi-Arn3.6.69.3
spi-Arn3.6.7.1
spi-Arn3.6.72.1
spi-Arn3.7.23.3
spi-Arn3.7.25.0
spi-Arn3.7.42.0
Other
spi-SpComp2-v20
spi-SpComp2-v9
spi-spcomp2-release-38.*
spi-spcomp2-release-38.0
spi-spcomp2-release-39.*
spi-spcomp2-release-39.1
spi-spcomp2-release-41.*
spi-spcomp2-release-41.0
spi-spcomp2-release-42.*
spi-spcomp2-release-42.0-rhel7
spi-spcomp2-release-43.*
spi-spcomp2-release-43.0
spi-spcomp2-release-44.*
spi-spcomp2-release-44.0
spi-spcomp2-release-44.1
spi-spcomp2-release-44.2
spi-spcomp2-release-45.*
spi-spcomp2-release-45.0
spi-spcomp2-release-45.1
spi-spcomp2-release-45.3
spi-spcomp2-release-45.4
spi-spcomp2-release-47.*
spi-spcomp2-release-47.0
spi-spcomp2-release-48.*
spi-spcomp2-release-48.0
spi-spcomp2-release-49.*
spi-spcomp2-release-49.1
spi-v7-Arn3.*
spi-v7-Arn3.4.73.3
spi-v8-Arn3.*
spi-v8-Arn3.4.73.6
spiArn-3.*
spiArn-3.6.74.0
spiArn-3.6.84.0
spiArn-3.6.86.0
spiArn-3.6.94.0
spiArn3.*
spiArn3.5.45.0
spiArn3.5.45.1
spiArn3.5.48.0
spiArn3.5.50.0
spiArn3.5.66.0
spiArn3.5.68.0
spiArn3.5.75.0
spiArn3.5.82.0
v2.*
v2.3.5.0-dev
v2.3.6.0-dev
v2.4.0.0-dev
v2.4.0.1-dev
v2.4.0.2-dev
v2.4.0.3-dev
v2.4.1.1-dev
v2.4.2.0-dev
v2.4.2.1-dev
v2.4.2.2-dev
v2.5.0.0-dev
v2.5.2.0-dev
v2.6.1.0-dev
v2.6.2.0-dev
v2.6.5.0-dev
v3.*
v3.0.0.0-beta1
v3.0.0.1-beta2
v3.0.0.2-RC1
v3.0.0.3
v3.0.1.0
v3.0.10.0
v3.0.10.1
v3.0.11.0
v3.0.12.0
v3.0.13.0
v3.0.14.0
v3.0.15.0
v3.0.16.0
v3.0.17.0
v3.0.18.0
v3.0.18.1
v3.0.19.0
v3.0.19.1
v3.0.2.0
v3.0.20.0
v3.0.3.0
v3.0.3.1
v3.0.4.0
v3.0.5.0
v3.0.6.0
v3.0.6.1
v3.0.7.0
v3.0.8.0
v3.0.8.1
v3.0.9.0
v3.1.10.0
v3.1.11.0
v3.1.12.0
v3.1.13.0
v3.1.13.1
v3.1.14.0
v3.1.14.1
v3.1.15.0
v3.1.4.0-beta
v3.1.5.0-beta2
v3.1.6.0-rc1
v3.1.6.1
v3.1.6.2
v3.1.7.0
v3.1.8.0
v3.1.9.0
v3.2.0.0-dev
v3.2.0.2-dev
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63419.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "88757115461202315318196602174383292768",
"length": 1214
},
"id": "CVE-2026-63419-0fc5882c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openimageio/commit/9cda48b150294c7f024e680a6c9b0402e50f4816",
"target": {
"file": "src/iff.imageio/iffinput.cpp",
"function": "IffInput::read_native_tile"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "29045872209946506225918996446286422010",
"length": 8341
},
"id": "CVE-2026-63419-289e27dd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openimageio/commit/9cda48b150294c7f024e680a6c9b0402e50f4816",
"target": {
"file": "src/iff.imageio/iffinput.cpp",
"function": "IffInput::readimg"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "219406730860939334578501043291006583210",
"length": 3433
},
"id": "CVE-2026-63419-48d6dba8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openimageio/commit/9cda48b150294c7f024e680a6c9b0402e50f4816",
"target": {
"file": "src/iff.imageio/iffinput.cpp",
"function": "IffInput::read_header"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"231408868653658965145330111104374330557",
"126149012185818063414304901304493943297",
"174981944368785305007623253146507035661",
"24529556265312807417231131959547324320",
"276766773435303500123312172629225621842",
"224269838773370672208241011997987290431",
"101660242689996276116420148285163626751",
"166262942741298452805167427878782058109",
"303585414278644843679998744087859191575",
"245766159732156439594108875440991351471",
"1998538216384101068762482251012175621",
"178867381775679728133076588279687161122",
"269716569626761411373191145889129808355",
"207207435472122517857803365598114845759",
"226695295619793764660875647149924714795",
"275421393983800324113406243757613924690",
"231533422352333542196451739312692457583",
"245653017364600163929819606910749933861",
"144383331229573945519684888715770458114",
"327739065756562959767261424637923567084",
"144480370892562577405973630375882975447",
"256449329096214087787842847719193232780",
"29836936532392816402763032038568197926",
"338162734889080174143202722324274343512",
"263282312155382506130997503448399744995",
"57191996358774629113910948407135510552",
"325447892281044241871491437853263912391",
"35682302227369159973652299602927026185",
"124591789874827246929740752614319733292",
"78145417691388889025349996653532448355",
"325425347544071119660492536381888737844",
"231521978081826881745195757623931788084",
"95505720400841188309831956937247543814",
"213572097174086057751938751734931106963",
"16638566162120960357142903065018849033",
"301240003579576823459803686034736585167",
"110240929531806917041548244490193544692",
"39845696267265541470275519679673851164",
"38555973702188469438815335566414557705",
"118625816763785597603682098311351764034",
"60309556602545377407251717033119866159",
"181096196127922574290505820635084904524",
"115982874918476305586589389026585188790",
"80731672105255479307615679020448838035",
"155902665931990013490548331869401651311"
],
"threshold": 0.9
},
"id": "CVE-2026-63419-92d44adf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openimageio/commit/9cda48b150294c7f024e680a6c9b0402e50f4816",
"target": {
"file": "src/iff.imageio/iffinput.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "121785538538014264161816718266193059820",
"length": 108
},
"id": "CVE-2026-63419-f17ad5e0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openimageio/commit/9cda48b150294c7f024e680a6c9b0402e50f4816",
"target": {
"file": "src/iff.imageio/iffinput.cpp",
"function": "read_chunk"
}
}
]
vanir_signatures_modified
"2026-09-20T14:13:50Z"