CVE-2026-65969: OpenImageIO TGA Processing DOS Vulnerability

CVE-2026-65969 Overview

CVE-2026-65969 affects OpenImageIO, an open-source toolset for reading, writing, and manipulating image files used across visual effects and animation pipelines. The vulnerability resides in the GIF output implementation, where a truncated TGA input can leave a pending GIF frame that is processed during output close. During palette construction, a signed 32-bit multiplication overflows, corrupting internal state and driving an out-of-bounds read [CWE-125]. The result is a process crash and denial of service in applications that convert or transcode attacker-supplied image data. Fixed versions are 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

Critical Impact
A crafted truncated TGA file processed through a GIF output path triggers an out-of-bounds read in GifSplitPalette(), crashing the host process and denying service to image-processing workloads.

Affected Products

OpenImageIO versions prior to 3.0.21.0
OpenImageIO versions prior to 3.1.16.0
OpenImageIO versions prior to 3.2.0.3-beta1

Discovery Timeline

2026-09-18 - CVE-2026-65969 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-65969

Vulnerability Analysis

The vulnerability lives in src/gif.imageio/gif.h within the GifSplitPalette() function. When OpenImageIO processes a truncated TGA input while a GIF output is active, a pending GIF frame remains queued and is flushed during output close. The palette-split routine partitions pixels for median-cut quantization and uses signed 32-bit arithmetic to compute how many pixels belong to each partition.

When an attacker supplies a sufficiently large image, the intermediate multiplication numPixels * (splitElt - firstElt) overflows the signed 32-bit range. The overflowed value corrupts subPixelsA, which then guides subsequent memory access during palette construction. The corrupted count drives an out-of-bounds read as the algorithm walks pixel data outside the intended buffer boundaries.

The defect is classified as an Out-of-Bounds Read [CWE-125] rooted in an integer overflow. Exploitation requires local delivery of a malicious file and user interaction to open or convert it through an OpenImageIO-backed pipeline.

Root Cause

The root cause is unchecked signed 32-bit arithmetic in GifSplitPalette(). The product of numPixels and the palette partition width can exceed INT32_MAX, producing a wrapped or negative value assigned to subPixelsA. A secondary instance of the same pattern exists in gifinput.cpp, where row offsets computed as y * m_spec.width * m_spec.nchannels can overflow for large canvases.

Attack Vector

An attacker crafts a truncated TGA file and delivers it to a workstation or render node running a vulnerable OpenImageIO release. When the file is processed through a code path that also opens a GIF output, the pending frame flush triggers the overflow during close. Successful exploitation causes an out-of-bounds read and process termination, disrupting batch pipelines, converters, or interactive DCC (Digital Content Creation) tools.

// Patch: src/gif.imageio/gif.h — widen intermediate to int64_t to prevent overflow
    if(bRange > gRange) splitCom = 2;
    if(rRange > bRange && rRange > gRange) splitCom = 0;

-    int subPixelsA = numPixels * (splitElt - firstElt) / (lastElt - firstElt);
+    int subPixelsA = (int)(int64_t(numPixels) * (splitElt - firstElt)
+                           / (lastElt - firstElt));
    int subPixelsB = numPixels-subPixelsA;

    GifPartitionByMedian(image, 0, numPixels, splitCom, subPixelsA);
// Source: https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/134977da625a84fc5a09a34321806f1fe0093c24

cpp

// Patch: src/gif.imageio/gifinput.cpp — promote row-offset math to 64-bit
    if (y < 0 || y > m_spec.height || !m_canvas.size())
        return false;

-    memcpy(data, &m_canvas[y * m_spec.width * m_spec.nchannels],
+    memcpy(data,
+           &m_canvas[int64_t(y) * int64_t(m_spec.width) * m_spec.nchannels],
           m_spec.width * m_spec.nchannels);

    return true;
// Source: https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/134977da625a84fc5a09a34321806f1fe0093c24

Detection Methods for CVE-2026-65969

Indicators of Compromise

Unexpected crashes or SIGSEGV terminations in processes linked against libOpenImageIO when handling TGA inputs or producing GIF outputs.
Truncated TGA files staged in asset ingest directories, render farm queues, or user download folders.
Application logs referencing GifSplitPalette, GIFOutput, or gif.imageio at the point of failure.

Detection Strategies

Inventory installed OpenImageIO builds and flag any version below 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 across workstations and render nodes.
Monitor for repeated crashes of image-processing tools such as oiiotool, maketx, or DCC applications embedding OpenImageIO.
Correlate crash telemetry with file access events involving .tga and .gif extensions to surface likely trigger files.

Monitoring Recommendations

Collect and centralize crash dumps for OpenImageIO consumers, retaining stack frames that reference GIF output symbols.
Alert on abnormal termination rates for automated media pipelines and batch conversion jobs.
Track file provenance for TGA assets entering pipelines from external contributors or shared storage.

How to Mitigate CVE-2026-65969

Immediate Actions Required

Upgrade OpenImageIO to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 on all affected systems.
Rebuild and redistribute internal tools and DCC plug-ins that statically link OpenImageIO against fixed releases.
Restrict ingestion of untrusted TGA files into automated GIF-producing workflows until patching is complete.

Patch Information

The fix widens the palette-split arithmetic to 64-bit before narrowing the result, eliminating the overflow. Details are documented in OpenImageIO Pull Request #5292, the OpenImageIO Commit Update, and the GitHub Security Advisory GHSA-9mwc-fjgj-8wmq. Fixed binaries are available in OpenImageIO Release v3.0.21.0 and OpenImageIO Release v3.1.16.0.

Workarounds

Disable GIF output paths in conversion pipelines that must accept untrusted TGA inputs.
Pre-validate TGA files for truncation and reject malformed headers before passing them to OpenImageIO.
Cap the maximum resolution of images allowed through GIF-producing routines to keep pixel counts well below values that trigger 32-bit overflow.

bash

# Example: verify installed OpenImageIO version and block old builds
oiiotool --version

# Enforce a minimum fixed version in build tooling
REQUIRED="3.0.21.0"
INSTALLED=$(oiiotool --version | awk '{print $2}')
printf '%s\n%s\n' "$REQUIRED" "$INSTALLED" | sort -V | head -n1 | grep -qx "$REQUIRED" \
  || { echo "OpenImageIO $INSTALLED is vulnerable to CVE-2026-65969"; exit 1; }