CVE-2026-65969: OpenImageIO: TGA-to-GIF palette split signed overflow causes SIGSEGV
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette() computes numpixels multiplied by the palette partition width in signed 32-bit arithmetic; a large image overflows that intermediate, corrupts subpixelsa, and drives an out-of-bounds read while building the gif palette, resulting in a process crash and denial of service. The affected implementation is identified by src/gif.imageio/gif.h, GifSplitPalette(), numPixels, subPixelsA, GIFOutput, and truncated TGA input, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.0.21.0 - Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.1.16.0 - Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.2.0.3-beta1
Event History
Frequently Asked Questions
Which releases contain the fix?
The issue is fixed in OpenImageIO 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. Releases prior to those versions are affected.
What input and processing conditions are needed to trigger the crash?
A truncated TGA input must leave a pending GIF frame that is processed when GIF output is closed. The vulnerable calculation also requires a large image such that numpixels multiplied by the palette partition width overflows signed 32-bit arithmetic.
What is the practical impact of successful exploitation?
The overflow corrupts subPixelsA and causes an out-of-bounds read while the GIF palette is built. This results in a process crash and denial of service.