CVE-2026-63422: OpenImageIO Buffer Overflow Vulnerability

CVE-2026-63422 Overview

CVE-2026-63422 is a heap out-of-bounds write [CWE-122] in OpenImageIO, a widely used toolset for reading, writing, and manipulating image files across VFX and animation pipelines. The flaw resides in OpenEXRInput::read_native_tiles() within src/openexr.imageio/exrinput.cpp. Processing a crafted tiled OpenEXR image whose width is not a multiple of its tile width triggers memory corruption when a caller reads a partial edge-tile rectangle. The affected releases are all OpenImageIO versions prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

Critical Impact
A malicious OpenEXR file can corrupt heap memory in any application linking OpenImageIO, enabling local code execution in the context of the affected process.

Affected Products

OpenImageIO versions prior to 3.0.21.0
OpenImageIO versions prior to 3.1.16.0
OpenImageIO versions prior to 3.2.0.3-beta1

Discovery Timeline

2026-09-18 - CVE-2026-63422 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63422

Vulnerability Analysis

OpenImageIO exposes OpenEXRInput::read_native_tiles() to load rectangular regions of a tiled EXR image into a caller-provided buffer. When the requested rectangle spans an edge tile whose logical width differs from the padded tile width, the implementation copies each row using the wrong stride. The routine uses the padded whole-tile scanline_stride value instead of user_scanline_bytes, which is sized for the requested rectangle. Each row copy therefore writes past the end of the caller's buffer, producing a heap out-of-bounds write and memory corruption. Attackers who supply a malicious tiled EXR file to an application built against a vulnerable OpenImageIO version can leverage this corruption to execute arbitrary code with the privileges of the host process.

Root Cause

The root cause is a stride mismatch during partial edge-tile handling. The destination row stride must equal the caller's requested rectangle width in bytes. The vulnerable code path computed the stride from the tile-aligned width, so writes for the final column of tiles overran the buffer whenever the image width was not a multiple of the tile width.

Attack Vector

Exploitation requires a local user to open or process a crafted OpenEXR file with an application that links OpenImageIO. User interaction is required, but no privileges or authentication are needed. Any content pipeline, renderer, viewer, or asset converter that accepts untrusted EXR inputs is a plausible target.

cpp

     size_t pixelbytes = m_spec.pixel_bytes(chbegin, chend, true);
     int firstxtile    = (xbegin - m_spec.x) / m_spec.tile_width;
     int firstytile    = (ybegin - m_spec.y) / m_spec.tile_height;
+    // Caller's buffer is sized for [xbegin, xend) before clamping below; that
+    // width, not the clamped one, is the destination row stride.
+    int requested_xend = xend;
     // clamp to the image edge
     xend = std::min(xend, m_spec.x + m_spec.width);
     yend = std::min(yend, m_spec.y + m_spec.height);

Source: GitHub Commit 7303134. The patch preserves the caller's original xend in requested_xend and derives the destination row stride from the requested rectangle rather than the tile-padded width.

Detection Methods for CVE-2026-63422

Indicators of Compromise

Crashes, aborts, or AddressSanitizer heap-buffer-overflow reports originating from OpenEXRInput::read_native_tiles() in exrinput.cpp or exrinput_c.cpp.
Unexpected termination of rendering tools, DCC applications, or asset converters immediately after loading a tiled EXR file.
Presence of tiled OpenEXR files where dataWindow width is not an integer multiple of the declared tileDesc.xSize.

Detection Strategies

Inventory build dependencies to identify applications statically or dynamically linked against OpenImageIO versions earlier than 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1.
Scan asset repositories for EXR files whose header metadata indicates non-tile-aligned image widths, and quarantine untrusted sources.
Run fuzzing or ASan-instrumented regression tests against read_native_tiles() code paths.

Monitoring Recommendations

Alert on process crashes for common OIIO-linked binaries such as oiiotool, iinfo, Blender, Nuke, Houdini, and Maya on workstations that ingest external EXR content.
Log and review inbound file transfers of .exr assets from untrusted collaborators or shared render farms.

How to Mitigate CVE-2026-63422

Immediate Actions Required

Upgrade OpenImageIO to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 or later on all build hosts, artist workstations, and render nodes.
Rebuild and redistribute downstream applications that statically link OpenImageIO after upgrading.
Restrict processing of EXR files from untrusted sources until patched binaries are deployed.

Patch Information

The fix is tracked in GitHub Pull Request #5295 and landed in commit 7303134. Fixed releases are available at OpenImageIO v3.0.21.0 and OpenImageIO v3.1.16.0. Full technical detail is in GHSA-xh5r-whph-qmc5.

Workarounds

Reject or pre-validate tiled EXR inputs whose dataWindow width is not a multiple of the tile width before passing them to OpenImageIO.
Isolate EXR processing pipelines inside sandboxed containers or non-privileged service accounts to limit blast radius.
Disable EXR ingestion in end-user tools that do not require the format until patched builds are deployed.

bash

# Verify installed OpenImageIO version and upgrade via package manager
oiiotool --version
# Example: build from patched source
git clone --branch v3.1.16.0 https://github.com/AcademySoftwareFoundation/OpenImageIO.git
cmake -S OpenImageIO -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --target install