CVE-2026-63635: OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid colormode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value to index fixed color-mode tables, causing a global out-of-bounds read and potentially a bogus allocation, resulting in denial of service. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::validateheader(), PSDInput::setup(), oiio:RawColor, psd:RawData, colormode, and modechannelcount, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.0.21.0 - Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.1.16.0 - Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.2.0.3-beta1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that process PSD files with either oiio:rawcolor or psd:rawdata enabled are exposed when running an affected release. The vulnerable path is in the PSD input handling code.
What must an attacker do to trigger the denial of service?
An attacker needs to supply a crafted PSD containing an invalid color_mode value and have it processed with oiio:rawcolor or psd:rawdata enabled. The invalid value can be used to index fixed color-mode tables and may cause a bogus allocation.
What versions contain the fix?
The issue is fixed in OpenImageIO 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. Earlier versions in those release lines are affected.
What can be done if upgrading is not immediately possible?
Avoid enabling oiio:rawcolor and psd:rawdata when processing PSD files, especially PSDs from untrusted sources. Restrict or defer processing of untrusted PSD input until an updated version can be deployed.
How can I assess whether an environment is currently at risk?
Check the installed OpenImageIO version and identify workflows that ingest PSD files. Those workflows are relevant if they enable oiio:rawcolor or psd:rawdata and use the affected PSD input implementation.