CVE-2026-63635

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value to index fixed color-mode tables, causing a global out-of-bounds read and potentially a bogus allocation, resulting in denial of service. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::validate_header(), PSDInput::setup(), oiio:RawColor, psd:RawData, color_mode, and mode_channel_count, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

• CWE-125
• CWE-129

• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/50481b0f90932a4675f65f3cc26407139cb9e20ePatch
• https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5282Issue Tracking, Patch
• https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.21.0Release Notes
• https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0Release Notes
• https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3c8w-9xvm-r6gfExploit, Mitigation, Vendor Advisory
• https://github.com/user-attachments/files/29539076/poc.zipExploit

Published

Sep 18, 2026

Last Modified

Sep 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63627mppx is a TypeScript interface for machine payments protocol…6.9
• CVE-2026-63628mppx is a TypeScript interface for machine payments protocol…6.9
• CVE-2026-6363Type Confusion in V8 in Google Chrome prior to 147.0.7727.10…8.8
• CVE-2026-63630BentoPDF is a client-side PDF toolkit that is self hostable.…3.4
• CVE-2026-63632Open Neural Network Exchange (ONNX) is an open standard for …3.3
• CVE-2026-63633FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2026-63637Dgraph is an open source distributed GraphQL database. Prior…8.6
• CVE-2026-63638OpenImageIO is a toolset for reading, writing, and manipulat…8.3
• CVE-2026-63639Valkey is a distributed key-value database. Prior to 7.2.14,…8.8
• CVE-2026-6364Out of bounds read in Skia in Google Chrome prior to 147.0.7…6.5
• CVE-2026-63640MagicMirror² is an open source modular smart mirror platform…4.3
• CVE-2026-63641MagicMirror² is an open source modular smart mirror platform…2.3