CVE-2026-63420

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. when oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers, resulting in a heap out-of-bounds read and process crash. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::read_native_scanline(), PSDInput::interleave_row(), oiio:RawColor, psd:RawData, channel_buffers, and spec.nchannels, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

• CWE-125
• CWE-129

• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/4995b25b8216552630e0aee0d8870e0d3aaae7ee
• https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5307
• https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.21.0
• https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0
• https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j
• https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j

Published

Sep 18, 2026

Last Modified

Sep 23, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63408Grav API Plugin is a RESTful API for Grav CMS that provides …7.5
• CVE-2026-63409Deskflow is a keyboard and mouse sharing app. From 1.17.0 un…8.2
• CVE-2026-6341Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 …4.3
• CVE-2026-63416draw.io is a configurable diagramming and whiteboarding appl…3.7
• CVE-2026-63419OpenImageIO is a toolset for reading, writing, and manipulat…7.8
• CVE-2026-6342Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 …4.3
• CVE-2026-63421Keystone is a content management system for Node.js. Prior t…7.5
• CVE-2026-63422OpenImageIO is a toolset for reading, writing, and manipulat…7.8
• CVE-2026-63423During an internal security assessment, a potential vulnerab…7.8
• CVE-2026-63424During an internal security assessment, an improperly protec…7.3
• CVE-2026-63425During an internal security assessment, a potential improper…7.8
• CVE-2026-63426During an internal security assessment, a potential vulnerab…7.1