CVE-2026-63638: OpenImageIO Buffer Overflow Vulnerability

CVE-2026-63638 Overview

OpenImageIO contains a heap out-of-bounds write vulnerability in the Cineon image format parser. A crafted Cineon image can declare an unsupported component bit depth of 26. The CineonInput::open() function maps this value to a 32-bit ImageSpec, while the vendored libcineon library maps the same unsupported depth to an 8-byte value. This mismatch causes CineonInput::read_native_scanline() to write attacker-controlled data past the 4-byte-per-pixel caller buffer, corrupting the heap. The flaw is tracked as [CWE-787] Out-of-Bounds Write and affects OpenImageIO versions prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

Critical Impact
An attacker who convinces a user or automated pipeline to process a malicious Cineon file can trigger heap memory corruption, potentially leading to arbitrary code execution in visual effects and animation workflows.

Affected Products

OpenImageIO versions prior to 3.0.21.0
OpenImageIO versions prior to 3.1.16.0
OpenImageIO versions prior to 3.2.0.3-beta1

Discovery Timeline

2026-09-18 - CVE-2026-63638 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63638

Vulnerability Analysis

The vulnerability resides in src/cineon.imageio/cineoninput.cpp, specifically in how CineonInput::open() validates channel bit depth values read from a Cineon image header. The Cineon format specifies component bit depth per channel, and OpenImageIO forwards this value to the vendored libcineon library for decoding.

When a crafted file declares bit depth 26, OpenImageIO accepts the value because it falls within its permissive range check of 1 to 32 bits. OpenImageIO then constructs an ImageSpec describing 32-bit channels, allocating scanline buffers at 4 bytes per pixel.

However, libcineon's internal ComponentDataSize() function does not recognize bit depth 26 as a supported value. It falls through to an 8-byte-per-component code path when decoding scanlines. During CineonInput::read_native_scanline(), the library writes 8 bytes of pixel data into the 4-byte-per-pixel buffer allocated by the caller, producing a heap out-of-bounds write.

Root Cause

The root cause is a validation gap between OpenImageIO and its vendored libcineon dependency. OpenImageIO trusts any bit depth between 1 and 32, while libcineon only correctly handles 8, 10, 12, 16, 32, and 64. Any other value produces a size mismatch between the allocated buffer and the bytes written per pixel.

Attack Vector

Exploitation requires a victim to open or process a malicious Cineon file. This can occur in VFX pipelines, render farms, asset ingestion services, or any application that embeds OpenImageIO for image conversion. Because OpenImageIO is widely used as a library in film production tooling, a single poisoned asset can propagate through automated processing chains.

cpp

     int maxbits = 0;
     for (int i = 0; i < nchannels; i++) {
         int b(m_cin.header.BitDepth(i));
-        if (b < 1 || b > 32) {
+        // libcineon's ComponentDataSize/ComponentByteCount only know how to
+        // handle these bit depths; anything else asserts (or worse, in a
+        // non-debug build) deep inside the vendored library. Reject bogus
+        // values here so we can give a proper error instead.
+        switch (b) {
+        case 8:
+        case 10:
+        case 12:
+        case 16:
+        case 32:
+        case 64: break;
+        default:
             errorfmt("Invalid bitdepth in channel {}: {} bits", i, b);
+            close();
             return false;
         }
         maxbits = std::max(maxbits, b);

Source: GitHub Commit 6f2b2e85. The patch replaces the broad range check with an explicit allow-list of the bit depths that libcineon actually supports and closes the file on rejection.

Detection Methods for CVE-2026-63638

Indicators of Compromise

Cineon (.cin) files whose header declares component bit depths other than 8, 10, 12, 16, 32, or 64
Unexpected process crashes or heap corruption alerts in applications embedding OpenImageIO when processing image assets
Anomalous child processes spawned by rendering or asset conversion services after ingesting a Cineon file

Detection Strategies

Inspect Cineon file headers at ingestion boundaries and reject any file declaring an unsupported BitDepth value
Run OpenImageIO-based tooling under AddressSanitizer in staging environments to surface out-of-bounds writes during regression testing
Monitor for OpenImageIO version fingerprints across build systems and container images to identify unpatched deployments

Monitoring Recommendations

Log all invocations of image conversion utilities (oiiotool, maketx, custom pipelines) with source file hashes for forensic review
Alert on crashes, segmentation faults, or abnormal termination of render farm workers processing external assets
Track process behavior of image-processing services for unexpected memory allocations or code execution attempts

How to Mitigate CVE-2026-63638

Immediate Actions Required

Upgrade OpenImageIO to version 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 or later across all build systems, containers, and workstations
Audit third-party VFX and animation tools for embedded OpenImageIO libraries and update or patch bundled copies
Restrict ingestion of Cineon files from untrusted sources until the patched version is deployed

Patch Information

The fix is committed in GitHub Commit 6f2b2e85 and merged via GitHub Pull Request #5283. Patched releases are available at OpenImageIO Release v3.0.21.0 and OpenImageIO Release v3.1.16.0. Full advisory details are in GitHub Security Advisory GHSA-9hxv-jvgr-3x8g.

Workarounds

Filter Cineon files at the pipeline entry point to allow only bit depths of 8, 10, 12, 16, 32, or 64
Run OpenImageIO-based converters in sandboxed or containerized environments with minimal privileges to limit blast radius
Disable the Cineon input plugin in OpenImageIO builds if the format is not required by the workflow

bash

# Verify the installed OpenImageIO version and upgrade if vulnerable
oiiotool --version

# Example: pin patched versions in a Python VFX environment
pip install --upgrade "OpenImageIO>=3.1.16.0"

# Example: reject Cineon files with unsupported bit depth before processing
oiiotool --info -v suspicious.cin | grep -Ei 'bitdepth|bits/channel'