CVE-2026-63420

Executive Summary

CVE-2026-63420 is a heap out-of-bounds read (CWE-125) vulnerability in OpenImageIO, the widely used image I/O toolset for VFX and animation pipelines. When an indexed PSD file with transparency metadata is processed with the oiio:rawcolor or psd:rawdata option enabled, the PSD reader advertises more channels (spec.nchannels) than it actually stores in its internal channel buffers, causing PSDInput::read_native_scanline() to pass the inflated channel count to PSDInput::interleave_row() and index past the allocated buffer. Successful triggering results in a heap out-of-bounds read and process crash (CVSS 3.1 score 5.5, availability impact only). Any application, render farm node, DCC integration, or automated media-processing pipeline that opens attacker-supplied PSD files with OpenImageIO versions prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 is affected.

Technical Analysis

OpenImageIO is a foundational library used across VFX, animation, and content-processing toolchains for reading, writing, and manipulating image files. The affected component is the PSD (Adobe Photoshop Document) reader implemented in src/psd.imageio/psdinput.cpp, specifically the functions PSDInput::read_native_scanline() and PSDInput::interleave_row().

The vulnerability class is a heap-based out-of-bounds read (CWE-125) arising from a metadata/state inconsistency. The description states that an indexed PSD file carrying transparency metadata causes the reader to allocate fewer stored channel_buffers than the number of channels advertised to the caller via spec.nchannels on the rawcolor code path. In other words, the channel count exposed by the rawcolor path and the actual number of channel buffers held in memory diverge.

When either the oiio:rawcolor or psd:rawdata option is enabled, the raw-data read path is taken. PSDInput::read_native_scanline() then passes the (inflated) spec.nchannels value to PSDInput::interleave_row(). Because interleave_row() uses that count to index into the channel_buffers array — which physically contains fewer entries than spec.nchannels — the iteration reads beyond the bounds of the allocated buffer. This is a read-only overrun: the memory is indexed and read, then the process crashes.

Key technical observations, all derivable from the NVD description:

• Root cause: an integer/count desynchronization between advertised channel count (spec.nchannels) and the number of actually allocated channel_buffers, specific to indexed PSDs with transparency metadata.
• Trigger condition: the raw paths — oiio:rawcolor or psd:rawdata — must be enabled. These are non-default, "give me raw data" reader options, so exposure is configuration-dependent.
• Impact mechanism: PSDInput::interleave_row() indexes beyond channel_buffers → heap OOB read → crash.
• Configuration note: the description does not specify how the options are enabled (API attribute, environment variable, or tool flag); that detail must be verified against the specific consuming application's configuration surface.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H confirms a local attack vector (the malicious file is supplied to a local process), low attack complexity, no privileges required, user interaction required (someone must open/process the file), unchanged scope, no confidentiality or integrity impact, and high availability impact (the crash).

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-63420 at the time of writing, and no Nuclei template or ExploitDB entry is tracked. The attack chain below is inferred from the vulnerability class and the specific mechanism described in the NVD entry.

1. Reconnaissance / target identification. An adversary identifies a target environment that ingests untrusted PSD files through OpenImageIO. Candidates include VFX and animation pipelines, render-farm ingestion services, automated media converters, asset-management/DAM systems, and any DCC (digital content creation) tool or CI job that calls OpenImageIO's PSD reader with the raw path enabled. The attacker determines whether the victim's pipeline enables oiio:rawcolor or psd:rawdata, since both are required to reach the vulnerable code path.

2. Triggering the flaw. The attacker crafts an indexed PSD file that carries transparency metadata structured so that the rawcolor path advertises more channels via spec.nchannels than the reader actually stores in channel_buffers. This is a malformed-metadata / channel-count mismatch, not a payload-bearing shellcode container. The file is delivered to the victim acquisition surface — an upload endpoint, a shared asset folder, a render submission queue, an email attachment, or a third-party asset drop.

3. Execution method at the vulnerability-class level. The victim process (or an automated pipeline) opens the crafted PSD with the raw path enabled. PSDInput::read_native_scanline() is invoked, which passes the inflated spec.nchannels to PSDInput::interleave_row(). interleave_row() indexes past the end of the channel_buffers allocation while reading, producing a heap out-of-bounds read. The read itself is not attacker-controlled memory corruption — it is an over-read, and the described outcome is a crash (availability impact). Because the flaw produces only a read and not a write, there is no stated path to code execution or data exfiltration from this CVE alone.

4. Post-exploitation impact. The immediate effect is denial of service: the worker, viewer, converter, or pipeline stage reading the file crashes. In shared render-farm or build environments, repeated submission of such files can repeatedly terminate workers, causing queue stalls and loss of in-flight work. The CVSS vector confirms C:N/I:N/A:H — no confidentiality or integrity loss. No authentication bypass, privilege escalation, or data exposure is described. Whether the OOB read could leak heap contents into a rendered image or log is not stated in the source data and should not be assumed.

Impact Assessment

CVSS 3.1: 5.5 (Medium) — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

• Attack Vector (Local): the malicious file must be supplied to a local process — typically via user upload or asset ingestion rather than direct network exploitation of a listening service.
• Attack Complexity (Low): the description states the condition is reachable deterministically when an indexed PSD with transparency metadata is opened via the raw path; no race or special conditions are required beyond the crafted file.
• Privileges Required (None): the attacker needs no credentials on the target.
• User Interaction (Required): a user or automated job must open/process the malicious file.
• Scope (Unchanged): impact is confined to the vulnerable component process.
• Confidentiality / Integrity (None): the described flaw is a read overrun with crash outcome only.
• Availability (High): the process crashes, which is a full loss of availability for that instance.

Blast radius. Any OpenImageIO version below the three fixed releases (3.0.21.0, 3.1.16.0, 3.2.0.3-beta1) is in scope. Systems most exposed are those that (a) process untrusted PSD input and (b) enable oiio:rawcolor or psd:rawdata. Where those raw options are disabled, the vulnerable path is not reached. Because OpenImageIO is frequently embedded as a library (rather than exposed as its own service), asset inventory is the primary challenge: the exposure surface is the consuming application, not a directly network-reachable daemon. Business impact concentrates on availability of media-processing and render workloads; there is no described data-loss or lateral-movement impact.

Detection Guidance

Because the flaw is triggered by local file parsing rather than network protocol interaction, network-layer signatures are inherently limited. The rules below emphasize host/process and file-based detection, with a best-effort network rule for the common case of PSD files uploaded to media-handling endpoints.

Sigma Rule

title: OpenImageIO PSD Raw Path Heap OOB Read Crash (CVE-2026-63420)
id: 8f3c2a91-7d44-4e0b-9c15-2a6b6f0d9e21
status: experimental
description: Detects crashes of OpenImageIO-based image processors potentially caused by a malformed indexed PSD with transparency metadata (CVE-2026-63420).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63420
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1203
  - cve.2026-63420
logsource:
  category: process_creation
  product: linux
detection:
  selection_bin:
    Image|endswith:
      - '/oiiotool'
      - '/iconvert'
      - '/idiff'
  selection_args:
    CommandLine|contains:
      - 'rawcolor'
      - 'rawdata'
  selection_ext:
    CommandLine|contains: '.psd'
  condition: selection_bin and (selection_args or selection_ext)
fields:
  - CommandLine
  - Image
falsepositives:
  - Legitimate batch processing of PSD files
level: low

YARA Rule

rule CVE_2026_63420_PSD_Indexed_Transparency_Channel_Mismatch
{
    meta:
        description = "Heuristic detection of indexed PSD files with transparency metadata that may trigger CVE-2026-63420 channel-count mismatch in OpenImageIO"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63420"
        date = "2026-01-01"
        cve = "CVE-2026-63420"

    strings:
        $magic = { 38 42 50 53 }          // "8BPS" PSD signature
        $indexed_psd = { 00 03 }          // color mode 3 (indexed) at offset 24-25

    condition:
        $magic at 0 and
        uint16be(0) == 0x3842 and
        filesize > 512 and
        // Color mode field (offset 24) == 3 => Indexed color mode
        uint16be(24) == 0x0003
}

Note: This YARA rule is a heuristic for locating indexed-color-mode PSD files — the precondition class described for this CVE. It does not parse transparency resource blocks; use it for triage and file-hunting, not as a definitive exploit indicator.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-63420 OpenImageIO PSD Upload with Raw Path Indicator"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"8BPS"; depth:64; http.request_body; content:".psd"; nocase; classtype:attempted-dos; reference:cve,2026-63420; sid:2026634200; rev:1;)

This rule flags PSD file uploads (PSD magic 8BPS) to HTTP endpoints, which represent the primary delivery vector for file-parsing DoS. It will match legitimate PSD uploads and should be scoped/tuned to media-ingestion endpoints.

Elastic Detection

process where event.type == "start" and
  process.name in ("oiiotool", "iconvert", "idiff") and
  (process.command_line : "*rawcolor*" or process.command_line : "*rawdata*" or process.command_line : "*.psd*")

Optional crash-correlation variant (Linux auditd/EDR signal collection):

process where event.action == "terminated" and
  process.name in ("oiiotool", "iconvert", "renderd", "python") and
  process.exit_code in (139, 134, -11)

Splunk SPL Query

index=main (Image IN ("*oiiotool","*iconvert","*idiff") OR CommandLine="*.psd*")
| search CommandLine="*rawcolor*" OR CommandLine="*rawdata*" OR CommandLine="*.psd*"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmds by host, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Crash-focused companion search (for logs containing process exit status):

index=main (exit_code=139 OR exit_code=134 OR exit_code=-11)
| search process_name IN ("oiiotool","iconvert","idiff")
| stats count by host, process_name, exit_code

Wazuh OSSEC Rule

<group name="openimageio,cve-2026-63420,">
  <rule id="100420" level="5">
    <decoded_as>json</decoded_as>
    <field name="command">\.(psd)$</field>
    <description>CVE-2026-63420: OpenImageIO-related process handled a PSD file (potential malformed indexed-transparency crash trigger)</description>
    <options>no_full_log</options>
  </rule>

  <rule id="100421" level="8">
    <if_sid>100420</if_sid>
    <field name="command">rawcolor|rawdata</field>
    <description>CVE-2026-63420: OpenImageIO raw color/data path invoked on PSD input - potential heap OOB read trigger</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, but no vendor advisory, commit hash, or release artifact is tracked by our sources. Validate any remediation against the official OpenImageIO repository and release notes before relying on it.

1. Immediate mitigations.

   • Where feasible, disable the raw paths: do not enable oiio:rawcolor or psd:rawdata for untrusted PSD input. The vulnerable code path requires one of these options.
   • If the raw paths cannot be disabled, block or quarantine untrusted PSD files at ingestion points and treat PSD as a high-risk input format.
   • Run image-processing workers with least privilege and process isolation (containers, cgroups) so a crash is contained and cannot exhaust shared services.
   • Add crash-loop alerting on image-processing workers to detect repeated terminations consistent with a malformed-file DoS.

2. Patch / upgrade steps.

   • Identify every consuming application that links OpenImageIO (asset managers, converters, DCC integrations, render tooling) — the library is often embedded and not separately inventoried.
   • Upgrade OpenImageIO to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 (or later) per the fixed-version list in the NVD description, matching the release line in use.
   • Verify the fix through the official project releases/advisories before closing the risk — patch confidence is currently 0/4 and vendor confirmation is pending in our tracked sources.

3. Long-term hardening.

   • Adopt a parser isolation architecture (sandboxed subprocesses, memory-limited workers) for all in-house image codecs that process untrusted files.
   • Maintain an SBOM / dependency inventory covering embedded native libraries such as OpenImageIO, and track CVE feeds against it.
   • Implement fuzzing in CI for image-parser entry points, especially raw/native scanline paths — this class of channel-count desync is well suited to coverage-guided fuzzing.
   • Enforce strict ingestion validation (magic-byte checks, format allow-listing) and prefer regenerating/flattening untrusted PSDs to a safe intermediate format before processing.

References

1. NVD — CVE-2026-63420: https://nvd.nist.gov/vuln/detail/CVE-2026-63420
2. MITRE CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
3. OpenImageIO project (source, releases, and advisories): https://github.com/AcademySoftwareFoundation/OpenImageIO
4. Academy Software Foundation — OpenImageIO project page: https://www.aswf.io/projects/openimageio/
5. CISA Known Exploited Vulnerabilities catalog (checked: CVE-2026-63420 is not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild note: No public proof-of-concept, no Nuclei template, and no exploit code are tracked for CVE-2026-63420. There is no evidence of exploitation in the wild and the CVE is not present in CISA KEV. The vulnerability is currently assessed as a post-disclosure, file-parsing availability bug with no observed adversary campaigns.