CVE-2026-63420

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63420
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63420.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63420
Aliases
  • GHSA-x877-h4xx-5m5j
Downstream
Related
Published
2026-09-18T15:36:51Z
Modified
2026-10-01T08:09:03Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
OpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row`
Details

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. when oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers, resulting in a heap out-of-bounds read and process crash. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::read_native_scanline(), PSDInput::interleave_row(), oiio:RawColor, psd:RawData, channel_buffers, and spec.nchannels, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125",
        "CWE-129"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63420.json"
}
References

Affected packages

Git / github.com/academysoftwarefoundation/openimageio

Affected ranges

Type
GIT
Repo
https://github.com/academysoftwarefoundation/openimageio
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
710eeafcf7cd75fbfd5e34387ee4c373aa875356
Introduced
a0940a9f1e4a8ff20edc9d550a4dea4723d1aa58
Fixed
4995b25b8216552630e0aee0d8870e0d3aaae7ee
Fixed
f3f12ab761fbccaa644937780e7246674033c407
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:openimageio:openimageio:3.2.0.0:dev:*:*:*:*:*:*",
        "cpe:2.3:a:openimageio:openimageio:3.2.0.2:dev:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.0.21.0"
        },
        {
            "introduced":  "3.1.0.0"
        },
        {
            "last_affected":  "3.1.16.0"
        },
        {
            "introduced":  "3.2.0.0-dev"
        },
        {
            "last_affected":  "3.2.0.0-dev"
        },
        {
            "introduced":  "3.2.0.2-dev"
        },
        {
            "last_affected":  "3.2.0.2-dev"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.2.0.0-dev
3.2.0.2-dev
Arnold-3.*
Arnold-3.4.72.0
Release-0.*
Release-0.10.0
Release-1.*
Release-1.0.0
Release-1.0.1
Release-1.1.0
Release-1.1.0-beta1
Release-1.1.0-beta2
Release-1.1.0-beta3
Release-1.1.0-beta4
Release-1.1.1
Release-1.3.0-dev
Release-1.3.1-dev
Release-1.3.2-dev
Release-1.3.3-dev
Release-1.3.4-dev
Release-1.3.5
Release-1.3.5-dev
Release-1.3.6-dev
Release-1.4.1dev
Release-1.4.2dev
Release-1.4.3dev
Release-1.4.4dev
Release-1.4.5dev
Release-1.4.6RC1
Release-1.5.0dev
Release-1.5.1dev
Release-1.5.2dev
Release-1.5.3dev
Release-1.5.4dev-pre-SIMD
Release-1.5.5dev
Release-1.5.6dev
Release-1.5.7dev
Release-1.6.1dev
Release-1.6.2dev
Release-1.6.3dev
Release-1.6.4dev
Release-1.6.6beta
Release-1.7.0dev
Release-1.7.1dev
Release-1.7.2dev
Release-1.7.3dev
Release-1.7.4dev
Release-1.7.5beta
Release-1.7.6RC1
Release-1.8.0dev
Release-1.8.1dev
Release-1.8.2dev
Release-1.8.3dev
Release-1.8.4dev
Release-1.9.1dev
Release-1.9.2dev
Release-1.9.3dev
Release-1.9.4dev
Release-2.*
Release-2.0.0-beta1
Release-2.0.1-RC1
Release-2.1.0-dev
Release-2.1.1-dev
Release-2.1.2-dev
Release-2.1.3-dev
Release-2.1.4.0-dev
Release-2.1.5.0-dev
Release-2.1.7-beta
Release-2.1.8.0-RC1
Release-2.2.0.0-dev
Release-2.2.1.0-dev
Release-2.2.1.1-dev
Release-2.2.2.0-dev
Release-2.2.3.0-dev
Release-2.3.0.0-dev
Release-2.3.1.0-dev
Release-2.3.2.0-dev
Release-2.3.3.0-dev
Release-2.3.4.0-dev
arnold-3.*
arnold-3.4.71.0
spi-Arn3.*
spi-Arn3.4.71.0
spi-Arn3.4.72.0
spi-Arn3.4.73.6
spi-Arn3.4.73.7
spi-Arn3.5.0.0
spi-Arn3.5.10.0
spi-Arn3.5.11.0
spi-Arn3.5.12.0
spi-Arn3.5.13.1
spi-Arn3.5.14.0
spi-Arn3.5.16.0
spi-Arn3.5.2.0
spi-Arn3.5.24.0
spi-Arn3.5.25.0
spi-Arn3.5.26.0
spi-Arn3.5.28.0
spi-Arn3.5.31.0
spi-Arn3.5.35.0
spi-Arn3.5.37.0
spi-Arn3.5.41.0
spi-Arn3.5.45.0
spi-Arn3.5.45.1
spi-Arn3.5.48.0
spi-Arn3.5.5.0
spi-Arn3.5.50.0
spi-Arn3.5.66.0
spi-Arn3.5.68.0
spi-Arn3.5.75.0
spi-Arn3.5.8.0
spi-Arn3.5.82.0
spi-Arn3.5.90.0
spi-Arn3.5.91.0
spi-Arn3.5.93.10
spi-Arn3.6.18.0
spi-Arn3.6.21.3
spi-Arn3.6.27.0
spi-Arn3.6.33.4
spi-Arn3.6.36.0
spi-Arn3.6.64.6
spi-Arn3.6.69.3
spi-Arn3.6.7.1
spi-Arn3.6.72.1
spi-Arn3.7.23.3
spi-Arn3.7.25.0
spi-Arn3.7.42.0
Other
spi-SpComp2-v20
spi-SpComp2-v9
spi-spcomp2-release-38.*
spi-spcomp2-release-38.0
spi-spcomp2-release-39.*
spi-spcomp2-release-39.1
spi-spcomp2-release-41.*
spi-spcomp2-release-41.0
spi-spcomp2-release-42.*
spi-spcomp2-release-42.0-rhel7
spi-spcomp2-release-43.*
spi-spcomp2-release-43.0
spi-spcomp2-release-44.*
spi-spcomp2-release-44.0
spi-spcomp2-release-44.1
spi-spcomp2-release-44.2
spi-spcomp2-release-45.*
spi-spcomp2-release-45.0
spi-spcomp2-release-45.1
spi-spcomp2-release-45.3
spi-spcomp2-release-45.4
spi-spcomp2-release-47.*
spi-spcomp2-release-47.0
spi-spcomp2-release-48.*
spi-spcomp2-release-48.0
spi-spcomp2-release-49.*
spi-spcomp2-release-49.1
spi-v7-Arn3.*
spi-v7-Arn3.4.73.3
spi-v8-Arn3.*
spi-v8-Arn3.4.73.6
spiArn-3.*
spiArn-3.6.74.0
spiArn-3.6.84.0
spiArn-3.6.86.0
spiArn-3.6.94.0
spiArn3.*
spiArn3.5.45.0
spiArn3.5.45.1
spiArn3.5.48.0
spiArn3.5.50.0
spiArn3.5.66.0
spiArn3.5.68.0
spiArn3.5.75.0
spiArn3.5.82.0
v2.*
v2.3.5.0-dev
v2.3.6.0-dev
v2.4.0.0-dev
v2.4.0.1-dev
v2.4.0.2-dev
v2.4.0.3-dev
v2.4.1.1-dev
v2.4.2.0-dev
v2.4.2.1-dev
v2.4.2.2-dev
v2.5.0.0-dev
v2.5.2.0-dev
v2.6.1.0-dev
v2.6.2.0-dev
v2.6.5.0-dev
v3.*
v3.0.0.0-beta1
v3.0.0.1-beta2
v3.0.0.2-RC1
v3.0.0.3
v3.0.1.0
v3.0.10.0
v3.0.10.1
v3.0.11.0
v3.0.12.0
v3.0.13.0
v3.0.14.0
v3.0.15.0
v3.0.16.0
v3.0.17.0
v3.0.18.0
v3.0.18.1
v3.0.19.0
v3.0.19.1
v3.0.2.0
v3.0.20.0
v3.0.3.0
v3.0.3.1
v3.0.4.0
v3.0.5.0
v3.0.6.0
v3.0.6.1
v3.0.7.0
v3.0.8.0
v3.0.8.1
v3.0.9.0
v3.1.10.0
v3.1.11.0
v3.1.12.0
v3.1.13.0
v3.1.13.1
v3.1.14.0
v3.1.14.1
v3.1.15.0
v3.1.4.0-beta
v3.1.5.0-beta2
v3.1.6.0-rc1
v3.1.6.1
v3.1.6.2
v3.1.7.0
v3.1.8.0
v3.1.9.0
v3.2.0.0-dev
v3.2.0.2-dev

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63420.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "113433131745820174210567564910547020876",
            "length":  3627
        },
        "id":  "CVE-2026-63420-42a82e50",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/4995b25b8216552630e0aee0d8870e0d3aaae7ee",
        "target":  {
            "file":  "src/psd.imageio/psdinput.cpp",
            "function":  "PSDInput::read_native_scanline"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "53335725701661835711838138303739026901",
                "331040706365965180055016429267877404117",
                "104274889921675521405742258723302381902",
                "171584552146025949103102261944351875284",
                "285816943858758238505262271445321669878",
                "73176495845862779245633921508515923387",
                "27345776266447914621861953115127811186",
                "197096664837430036424109235877144826858",
                "305707556965919183175036625854984969856",
                "213333672302635638517329850868073662560",
                "156019083405631263023060805598430478620",
                "176474867090834431246526185352999853273",
                "225358147760002176025791638709211074892",
                "238194218990249602492609386240378266308",
                "254054615863420555306207132400798215817",
                "104650966476031449841069089338906103586",
                "8169541065342737646549961873823752041",
                "187952233355587476047739908414785874024",
                "163102815055486943370296380769736406204",
                "280895743674826494083839649095772941251",
                "307015777299353702841596875512223720229",
                "255694587430692136455097703630332028163",
                "4604589112508092635717332248648714131",
                "39159442965443270386409705090262307022",
                "231385458867473433660432055508821970445",
                "307015777299353702841596875512223720229",
                "59675740721691983110017747046329080774",
                "94281920527267536428643070809809327562",
                "115704572386026845673109440373749511144",
                "166453720047758236109517813847924957640",
                "307015777299353702841596875512223720229",
                "26971940213959518138028288208873452172",
                "204957898507306241094012795225559127429",
                "177992003071349656110518406928518650033",
                "153526335169076185236184494542609449195",
                "213731689601789820713054289858880228256",
                "180349502694272003791336430827864792937",
                "249436038260000353795009005585039669792",
                "228394983434159899788696283244626668870",
                "96647159055594729916684705768521933486",
                "59662059751421205456085041245497662637",
                "43184623150427807158785811060326956627",
                "249259947463392284279001488895154961685",
                "108159851692430856763481358387047954536",
                "223336419092575731791944044728584181906"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63420-42fde4c5",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openimageio/commit/4995b25b8216552630e0aee0d8870e0d3aaae7ee",
        "target":  {
            "file":  "src/psd.imageio/psdinput.cpp"
        }
    }
]
vanir_signatures_modified 
"2026-10-01T08:09:03Z"