CVE-2026-59956: OpenImageIO Buffer Overflow Vulnerability

CVE-2026-59956 Overview

CVE-2026-59956 is an out-of-bounds read vulnerability in OpenImageIO, a widely used toolset for reading, writing, and manipulating image files across visual effects and animation pipelines. The flaw exists in the IFF image reader and is triggered when parsing an uncompressed 16-bit IFF image that contains a z-buffer. The IffInput::readimg() function allocates a scanline buffer sized by m_header.rgba_count but copies data using the larger m_header.pixel_bytes() stride, which includes z-buffer bytes. The oversized memcpy reads past the temporary heap buffer, causing a crash or disclosure of adjacent heap memory. The issue is fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.

Critical Impact
A crafted IFF image processed by a vulnerable OpenImageIO build can crash the host application or leak adjacent heap contents into the decoded image output.

Affected Products

OpenImageIO versions prior to 3.0.20.0
OpenImageIO 3.1.x versions prior to 3.1.15.0
OpenImageIO 3.2.x versions prior to 3.2.0.3-beta1

Discovery Timeline

2026-09-18 - CVE-2026-59956 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-59956

Vulnerability Analysis

The vulnerability resides in src/iff.imageio/iffinput.cpp within the IffInput::readimg() function. When decoding an uncompressed 16-bit IFF file that includes a z-buffer channel, the reader allocates a temporary scanline buffer sized to the RGBA channel count only. The subsequent copy uses a stride that also includes the z-buffer bytes, so the source read extends beyond the allocated region. This produces an out-of-bounds heap read classified under [CWE-125].

Because the oversized memcpy transfers adjacent heap memory into the destination image buffer, downstream consumers may render, save, or otherwise expose data that originated outside the intended source allocation. The attack requires user interaction: a victim must open or process a malicious IFF file with a vulnerable OpenImageIO build.

Root Cause

The root cause is a mismatch between the allocation size and the copy stride. m_header.rgba_count governs the buffer allocation, while m_header.pixel_bytes() governs the copy length. For 16-bit IFF images that declare a z-buffer, pixel_bytes() exceeds rgba_count in width, producing a linear over-read on every scanline processed.

Attack Vector

Exploitation requires local file processing. An attacker delivers a crafted uncompressed 16-bit IFF image with a z-buffer to a target user or automated pipeline. When the file is opened by an application that links against a vulnerable OpenImageIO, IffInput::readimg() performs the oversized read. Consequences include process crash (denial of service) and disclosure of heap-adjacent data through the decoded pixel output. Detailed fix context is available in the GitHub Security Advisory GHSA-hjfv-gvxc-qgvh and the corresponding GitHub Pull Request #5251.

Detection Methods for CVE-2026-59956

Indicators of Compromise

Unexpected crashes or segmentation faults in applications linking OpenImageIO when opening .iff files.
Rendered or converted images that contain visually anomalous data at scanline boundaries, indicating leaked heap content.
Presence of untrusted 16-bit IFF files in asset ingestion pipelines or render farms.

Detection Strategies

Inventory OpenImageIO library versions across build environments, artist workstations, and render nodes; flag any version below 3.0.20.0, 3.1.15.0, or 3.2.0.3-beta1.
Enable AddressSanitizer or a heap fuzzer against IffInput::readimg() in test environments to confirm exposure.
Monitor process crash telemetry from digital content creation tools (Maya, Nuke, Blender plugins, Houdini) that consume IFF assets.

Monitoring Recommendations

Alert on repeated crashes of image-processing utilities such as oiiotool, iinfo, or iconvert when handling IFF inputs.
Track file provenance for .iff assets entering pipelines from external contributors or third-party vendors.
Correlate crash dumps with recently opened IFF files to identify targeted delivery attempts.

How to Mitigate CVE-2026-59956

Immediate Actions Required

Upgrade OpenImageIO to 3.0.20.0, 3.1.15.0, or 3.2.0.3-beta1 on all systems that process untrusted image files.
Rebuild and redeploy downstream applications and plugins that statically link OpenImageIO.
Restrict processing of externally sourced IFF files until patched builds are in place.

Patch Information

The fix is delivered through GitHub Commit f01bd16 and merged via GitHub Pull Request #5251. Patched artifacts are available in OpenImageIO Release v3.0.20.0 and OpenImageIO Release v3.1.15.0. The patch aligns the scanline allocation with the correct pixel stride so memcpy no longer reads past the buffer.

Workarounds

Disable or block the IFF input plugin in OpenImageIO configurations where IFF support is not required.
Gate ingestion pipelines to reject 16-bit IFF files containing a z-buffer channel until the patched runtime is deployed.
Run image conversion workloads inside sandboxed or containerized processes so a crash or leak does not affect the host.

bash

# Verify installed OpenImageIO version and upgrade
oiiotool --version
pip install --upgrade "OpenImageIO>=3.1.15.0"
# Or, for source builds, check out the fixed tag before compiling
git checkout v3.1.15.0