CVE-2026-63419

Executive Summary

CVE-2026-63419 is a heap out-of-bounds write (CWE-787) in OpenImageIO, a widely used image I/O library for VFX and animation pipelines. The flaw occurs in the IFF image format decoder when processing a tiled IFF file that exposes a "zbuffer-only" channel layout: the public ImageSpec advertises a 16-bit pixel size while the decoder retains a 32-bit internal pixel buffer, and a size-mismatch copy inside IffInput::read_native_tile() writes past the end of a caller-allocated buffer. Affected versions are prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. Impact includes memory corruption with high confidentiality, integrity, and availability consequences (CVSS 3.1 base 7.8), exploitable in the context of a user or application processing a crafted IFF file.

Technical Analysis

OpenImageIO is a toolset and library for reading, writing, and manipulating image files across many formats used in VFX and animation. This CVE affects the IFF (Interchange File Format, historically used by Maya/Softimage and other DCC tools in the visual effects pipeline) input reader.

The vulnerability is rooted in a buffer size contract violation:

• A zbuffer-only tiled IFF file is parsed, and the public ImageSpec is generated with a 16-bit pixel specification.
• Internally the decoder continues to retain a 32-bit internal pixel size.
• In src/iff.imageio/iffinput.cpp, the function IffInput::read_native_tile() performs its copy based on m_header.pixel_bytes() (the internal 32-bit size) instead of the caller-visible ImageSpec::tile_bytes(true) value (the 16-bit size the caller allocated for).
• A failed read can leave the internal buffer m_buf in a nonempty state; a subsequent call to the same function then copies partially initialized data into the already undersized caller buffer.
• The result is a heap out-of-bounds write past the destination buffer boundary, causing memory corruption.

The NVD description names the following concrete implementation elements that define the defect:

• Source path: src/iff.imageio/iffinput.cpp
• Function: IffInput::read_native_tile()
• Public size accessor: ImageSpec::tile_bytes(true)
• Internal size accessor: m_header.pixel_bytes()
• Channel/format token: ZBUFFER
• Internal state buffer: m_buf

The root cause is a discrepancy between the advertised (public) and internal pixel/stride sizes, combined with state that is not reset after a failed tile read. This is a classic type-confusion-of-size-class bug where two independent code paths do not agree on the byte count of the destination region.

The defect was addressed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. No patch commit hash, advisory URL, or workaround is provided in the supplied data set.

Attack surface: any application, service, or pipeline that uses OpenImageIO to read untrusted IFF files — image ingest gateways, asset-management render farms, thumbnailing microservices, texture-conversion tools, and CLI utilities built on the library. Because the trigger requires a crafted IFF file to be opened, the attack vector is local with user interaction (CVSS: AV:L/AC:L/PR:N/UI:R).

Exploitation Scenarios

No public proof-of-concept exists; the attack chain below is inferred from the vulnerability class (CWE-787, heap out-of-bounds write via size mismatch). Only function/state names present in the NVD description are referenced.

1. Reconnaissance / target identification. An adversary identifies a target that processes user-supplied or third-party IFF imagery through OpenImageIO — e.g., a render-farm converter, an automated asset-ingest service, or a desktop DCC tool using the library. The IFF format's role in legacy VFX pipelines makes internal animation-asset exchange a plausible injection point. The attacker needs only the ability to deliver a file that the victim will open or have processed.

2. Triggering the flaw (abbreviated chain).

   • The attacker crafts a tiled IFF file that is zbuffer-only and whose declared public pixel spec is 16-bit, while forcing the decoder to retain a 32-bit internal pixel size.
   • When the victim application opens the file, OpenImageIO dispatches to IffInput::read_native_tile() (src/iff.imageio/iffinput.cpp).
   • The function computes the copy length from the internal m_header.pixel_bytes() instead of the public ImageSpec::tile_bytes(true), so it copies 32-bit-per-pixel data into a buffer the caller sized for 16-bit-per-pixel data.
   • If an initial read fails, m_buf is left nonempty; a second call to the same function copies partially initialized data into the undersized caller buffer, producing a heap out-of-bounds write.

3. Payload / execution (vulnerability-class level). The overflow condition is a heap corruption primitive. The attacker's leverage is the ability to write beyond a heap allocation with controlled or partially-controlled content. Exploitation typically involves heap grooming so the corrupted chunk lands adjacent to a victim object, followed by triggering a subsequent allocation/free to gain further primitive control. No specific exploitation technique is documented for this issue.

4. Post-exploitation impact. CVSS subscores indicate High Confidentiality, High Integrity, and High Availability impact within the vulnerable component. Consequences can include disclosure of memory contents, corruption of processed image/asset outputs, crashes (denial of service), and — depending on heap layout and process privileges — potential code execution in the context of the process opening the file. The score is bounded (S:U) because the vulnerable component is scoped to the library process.

Note: No public exploit, Nuclei template, or observed in-the-wild exploitation has been recorded in the supplied intelligence.

Impact Assessment

• CVSS 3.1: 7.8 (High) — AV:L / AC:L / PR:N / UI:R / S:U / C:H / I:H / A:H.
  • AV:L: exploitation requires delivering/opening a crafted local file to the target's OpenImageIO-enabled process.
  • AC:L: no special conditions beyond the malformed file are required per NVD.
  • PR:N: no authentication is needed to trigger the library flaw.
  • UI:R: a victim (human or automated pipeline step) must open the malicious IFF.
  • C:H / I:H / A:H: memory corruption can leak data, corrupt image/asset output, and crash the process.
• Business impact. Organizations using OpenImageIO in content-production pipelines face risks to asset integrity, rendering availability, and potential leakage of in-memory data. A compromise in a shared render service could affect multiple downstream productions.
• Blast radius. OpenImageIO is embedded in a broad ecosystem of VFX tools, converters, and asset-management systems. Any component that ingests IFF files with the vulnerable versions is in scope; the range of affected products is not enumerated in the supplied data.
• Exploitability current state. No PoC, no Nuclei template, no CISA KEV listing, EPSS not yet scored — but the technical description is sufficiently detailed that a competent researcher can reproduce it. Treat as a latent, high-severity memory-safety issue.

Detection Guidance

Detection for this file-format vulnerability is primarily endpoint/host-based (crashes, unusual IFF file activity) plus process-CLI and hash-based signatures. Network-layer rules are heuristic and target file-upload channels where IFF payloads are delivered.

Sigma Rule

title: OpenImageIO IFF Reader Heap Corruption Exploitation Attempt (CVE-2026-63419)
id: 3f9a1c40-9c1a-4b2e-8e77-1a0c2b6f7d11
status: experimental
description: Detects processes loading OpenImageIO libraries and handling IFF files consistent with the tile-decoder heap out-of-bounds write described in CVE-2026-63419.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63419
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - '\oiiotool.exe'
        - '\iconvert.exe'
        - '\idiff.exe'
  selection_cli:
    CommandLine|contains:
      - '.iff'
      - '.iff.gz'
  selection_dll:
    ImageLoaded|contains:
      - 'OpenImageIO'
      - 'libOpenImageIO'
  condition: (selection_img and selection_cli) or selection_dll
falsepositives:
  - Legitimate VFX asset processing pipelines using IFF imagery
level: medium
tags:
  - attack.t1203
  - attack.execution

YARA Rule

rule CVE_2026_63419_OpenImageIO_IFF_ZBUFFER_Tiled
{
    meta:
        author = "valtersit.com"
        description = "Detects IFF files containing tiled zbuffer-only structures that may trigger the CVE-2026-63419 heap out-of-bounds write in OpenImageIO."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63419"
        date = "2026-01-01"
        cve = "CVE-2026-63419"
        hash = "unknown"

    strings:
        $iff_magic = { 46 4F 52 4D }              // "FORM"
        $iff_type  = { 49 46 46 }                  // "IFF"
        $zbuffer   = "ZBUFFER" ascii
        $tbmp_chunk = "TBMP" ascii                  // tiled image data heuristics
        $zbuf_chunk = "ZBUF" ascii

    condition:
        $iff_magic at 0 and $iff_type and $zbuffer and any of ($tbmp_chunk, $zbuf_chunk)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-63419 OpenImageIO IFF ZBUFFER Tiled File Upload Attempt"; flow:to_server,established; http.method; content:"POST"; http.request_body; content:"FORM"; depth:4; content:"IFF"; content:"ZBUFFER"; reference:cve,CVE-2026-63419; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-63419; classtype:attempted-user; sid:2026063401; rev:1;)

Elastic Detection

process where process.name in ("oiiotool", "iconvert", "idiff") and
  process.args : "*.iff*"

Splunk SPL Query

| tstats `security_content_summariesonly`
    count min(_time) as firstTime max(_time) as lastTime
    from datamodel=Endpoint.Processes
    where Processes.process_name IN ("oiiotool","iconvert","idiff")
      AND (Processes.process="*.iff*" OR Processes.parent_process_name="*oiiotool*")
    by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `drop_dm_object_name(Processes)`

Wazuh OSSEC Rule

<group name="openimageio,cve-2026-63419,">
  <rule id="100640" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">oiiotool|iconvert|idiff</field>
    <field name="process.args">\.iff</field>
    <description>CVE-2026-63419: OpenImageIO process handling IFF file - possible heap corruption trigger</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
  <rule id="100641" level="12">
    <if_sid>100640</if_sid>
    <field name="event.action">crashed|segfault|access_violation</field>
    <description>CVE-2026-63419: OpenImageIO process crashed while processing IFF file - possible OOB write exploitation</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• The NVD description states the issue is fixed in 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. Upgrade to (or above) the appropriate fixed version for your release branch as the primary remediation.
• Until upgrade is possible, do not process untrusted IFF files with OpenImageIO-based tooling. Restrict or block IFF ingestion at upload/asset gateways for untrusted sources.
• Isolate image-processing services in low-privilege sandboxes/containers with seccomp, no network egress, and limited filesystem access to reduce the blast radius of a memory-corruption failure.
• Enforce secure-acceptable-file lists at ingest gateways: reject IFF files from external parties unless explicitly required; prefer pre-validated, allowlisted formats.
• Monitor for process crashes (segfaults, access violations) in OpenImageIO consumers and treat clusters of crashes on IFF inputs as a potential exploitation indicator.

2) Patch/upgrade steps

• Update to OpenImageIO 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 (or later) per the fixed versions cited in NVD.
• Rebuild any statically linked downstream consumers against the fixed library, and redeploy container images and packages that bundle OpenImageIO.
• Re-ingest and re-validate any IFF assets processed by affected versions if integrity is a concern.

3) Long-term hardening

• Adopt a strict "untrusted file" boundary: process all third-party imagery through a dedicated, sandboxed, memory-safe service where feasible, rather than in the main application process.
• Enable fuzzing (AFL++/libFuzzer/Oss-Fuzz-style) on the IFF reader path and add assertions comparing ImageSpec::tile_bytes(true) and internal decimal pixel sizes — the very mismatch this CVE exposes.
• Deploy address/memory sanitizers (ASan, MSan) in staging and CI to catch bounds errors before release.
• Track upstream OpenImageIO releases and subscribe to its security advisories; treat VFX asset-processing services as attack-surface-bearing infrastructure.

References

• NVD — CVE-2026-63419: https://nvd.nist.gov/vuln/detail/CVE-2026-63419
• CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• OpenImageIO project (upstream source and release notes): https://github.com/AcademySoftwareFoundation/OpenImageIO
• FIRST EPSS — not yet scored for this CVE (no value available)

Threat-actor and in-the-wild evidence: None. There is no CISA KEV listing, no public PoC, no exploit code, and no Nuclei template recorded for CVE-2026-63419 in the supplied intelligence.