CVE-2026-63422: OpenImageIO OpenEXR plugin partial edge tile heap out-of-bounds write
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads a partial edge-tile rectangle. openexrinput::readnativetiles() copies each row into the caller buffer using the padded whole-tile scanlinestride rather than userscanlinebytes for the requested rectangle, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/openexr.imageio/exrinput.cpp, OpenEXRInput::readnativetiles(), partial edge tile, userscanlinebytes, and scanlinestride, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenImageIO (OpenEXR plugin)to a version that resolves this vulnerability.Fixed in 3.0.21.0 - Upgrade
Upgrade
OpenImageIO (OpenEXR plugin)to a version that resolves this vulnerability.Fixed in 3.1.16.0 - Upgrade
Upgrade
OpenImageIO (OpenEXR plugin)to a version that resolves this vulnerability.Fixed in 3.2.0.3-beta1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using OpenImageIO versions earlier than 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 are affected if they read tiled OpenEXR images through the affected tile-reading path.
What input and operation are required to trigger the flaw?
A valid tiled OpenEXR image whose width is not a multiple of its tile width is required. The caller must read a partial rectangle from an edge tile, causing OpenEXRInput::read_native_tiles() to use the padded whole-tile scanline stride instead of the requested rectangle's scanline size.
Does exploitation require authentication or user interaction?
The supplied vector indicates no privileges are required and that user interaction is required. Exploitation is local, so an attacker needs a way to cause the affected application to process the crafted image.
What should be done if an immediate upgrade is not possible?
Avoid processing tiled OpenEXR files with image widths that are not multiples of the tile width, particularly where the application reads partial edge-tile rectangles. Restrict or defer processing of untrusted OpenEXR inputs until an affected version can be upgraded.
How can I determine whether code is affected?
Inspect the deployed OpenImageIO version and upgrade to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 or later in the corresponding release line. Source-based builds can also be checked for the affected implementation in src/openexr.imageio/exrinput.cpp, specifically OpenEXRInput::read_native_tiles().