CVE-2026-63422

Executive Summary

CVE-2026-63422 is a heap-based out-of-bounds write vulnerability (CWE-122) in OpenImageIO, a widely used image I/O library in VFX and animation pipelines. The flaw is triggered when processing a valid tiled OpenEXR image whose width is not a multiple of its tile width, causing read_native_tiles() to write beyond the caller's buffer during partial edge-tile reads. With a CVSS score of 7.8, successful exploitation requires user interaction to open a malicious image but can result in full memory corruption, potentially leading to code execution in the context of the affected application.

Technical Analysis

OpenImageIO is a core toolset for reading, writing, and manipulating image files across formats relevant to VFX/animation workflows. The vulnerability resides in the OpenEXR input plugin at src/openexr.imageio/exrinput.cpp, specifically within OpenEXRInput::read_native_tiles().

The root cause is a buffer size mismatch during partial edge-tile reads. When a tiled OpenEXR image has a width that is not an exact multiple of its tile width, the rightmost (edge) tiles are only partially populated with valid pixel data. When a caller requests a partial edge-tile rectangle, the implementation copies each row into the destination buffer using scanline_stride — the padded whole-tile stride — rather than user_scanline_bytes, which reflects the byte count of the actually requested rectangle. Because the padded stride is larger than the user-requested row length, each row write overruns the caller-provided buffer, producing a heap out-of-bounds write and consequent memory corruption. This is a classic stride/boundary calculation defect: valid input files drive an incorrect copy length into an undersized allocation.

The attack surface is any application, service, or pipeline stage that ingests untrusted OpenEXR tiled images through OpenImageIO. The vulnerability is not remotely reachable without file processing; it is triggered at parse/decode time. The CVSS vector reflects local access (AV:L) with user interaction required (UI:R), meaning an attacker must deliver the file and convince the victim to open/process it, but exploitation itself needs no privileges (PR:N) and results in high confidentiality, integrity, and availability impact (C:H/I:H/A:H).

Affected versions are those prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. No public exploit code, PoC, or Nuclei template is available. EPSS has not scored this CVE. Patch confidence is 0/4 — no vendor patch evidence has been tracked by our sources, although the NVD description indicates fix versions exist.

Exploitation Scenarios

1. Reconnaissance / target identification: An attacker identifies a target that processes OpenEXR images via OpenImageIO — for example, a render farm, asset pipeline, image conversion service, or a desktop VFX/Paint/Compositing application using the library. Publicly, an attacker may not have direct network visibility into these pipelines; delivery is typically via file exchange, shared asset repositories, or email attachments.

2. Trigger mechanism (vulnerability-class level): The attacker crafts a valid tiled OpenEXR image whose image width is not a multiple of the tile width, guaranteeing the presence of partial edge tiles. When the victim application reads a partial edge-tile rectangle through the OpenEXR input plugin, read_native_tiles() performs its row copy using the padded whole-tile scanline_stride instead of the user's requested user_scanline_bytes. The oversized stride causes a heap out-of-bounds write, corrupting adjacent heap memory.

3. Payload/execution (vulnerability-class level): The corrupted heap data may lead to crashes, denial of service, or, depending on allocator behavior and surrounding application memory layout, controlled memory corruption that an attacker could leverage toward code execution. The exact exploitation primitive (e.g., what object is overwritten) is not described in available data and cannot be reliably specified. No public PoC exists; the attack chain is inferred from the CWE-122 class and the described stride/bounds defect. User interaction is required because the malicious image must be opened or processed by the victim.

4. Post-exploitation impact: If memory corruption is weaponized, the adversary may achieve arbitrary code execution in the context of the image-processing application, enabling data exfiltration, lateral movement within a production network, or persistent compromise of artist workstations and render nodes. Even without weaponization, repeated crashes can disrupt production pipelines.

Impact Assessment

The CVSS 3.1 base score is 7.8 (High), with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack requires local delivery and user interaction to open a malicious file, which lowers the accessibility compared to a network wormable flaw. However, no privileges are required and the low attack complexity means that once delivered, exploitation is straightforward in terms of triggering the defect. The impact to confidentiality, integrity, and availability is High because heap memory corruption can lead to full compromise of the process, arbitrary code execution, data leakage, or denial of service. The scope is unchanged (S:U), meaning the vulnerable component's compromise does not inherently extend beyond its security authority, but in practice, shared image-processing services and pipeline daemons may run with broad access to shared storage and credentials. The blast radius includes any environment using OpenImageIO for untrusted image ingestion: VFX studios, animation pipelines, cloud rendering services, and third-party applications embedding the library. Because tiled OpenEXR is a standard production format, the attack file may appear entirely legitimate.

Detection Guidance

Sigma Rule

title: Potential OpenImageIO Tiled OpenEXR Heap Overflow Attempt
id: 5a1b9c3e-7f2d-4e8a-9b1c-6d4f2a8e7c01
status: experimental
description: Detects processing of tiled OpenEXR files by applications using OpenImageIO, which may indicate exploitation of CVE-2026-63422.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63422
author: Valters IT Threat Intelligence
date: 2026/06/01
tags:
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\oiiotool.exe'
      - '\iconvert.exe'
      - '\idiff.exe'
      - '\iv.exe'
  selection_ext:
    CommandLine|contains: '.exr'
  condition: selection_img and selection_ext
falsepositives:
  - Legitimate VFX pipeline processing of tiled EXR assets
level: medium

YARA Rule

rule CVE_2026_63422_OpenEXR_Tiled_Edge_Overflow
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects tiled OpenEXR files that may trigger the OpenImageIO read_native_tiles out-of-bounds write (CVE-2026-63422)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63422"
        date = "2026-06-01"
        severity = "high"

    strings:
        $exr_magic = { 76 2f 31 01 }
        $tiled = "tiles"

    condition:
        $exr_magic at 0 and $tiled
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-63422 Potential OpenImageIO Tiled OpenEXR Heap Overflow - EXR File Transfer"; flow:established,to_server; content:"|76 2f 31 01|"; depth:4; content:"tiles"; nocase; fast_pattern; classtype:attempted-user; reference:cve,2026-63422; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-63422; sid:2026634220; rev:1;)

Elastic Detection

process where process.name in ("oiiotool.exe", "iconvert.exe", "idiff.exe", "iv.exe") and
  process.command_line : "*.exr*"

Splunk SPL Query

index=endpoint (Image IN ("*\\oiiotool.exe","*\\iconvert.exe","*\\idiff.exe","*\\iv.exe") OR process_name IN ("oiiotool","iconvert","idiff","iv"))
    CommandLine="*.exr*"
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, Image, CommandLine
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="openimageio,cve-2026-63422,attack.t1204">
  <rule id="100634" level="8">
    <decoded_as>json</decoded_as>
    <field name="image">\.?(oiiotool|iconvert|idiff|iv)(\.exe)?$</field>
    <field name="command_line" type="pcre2">(?i)\.exr</field>
    <description>CVE-2026-63422: OpenImageIO processing of OpenEXR file - potential tiled edge overflow trigger</description>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, but our tracking sources have not confirmed a vendor advisory or commit. Treat as unpatched until vendor confirmation is obtained.

1. Immediate mitigations:

• Avoid opening or processing tiled OpenEXR files from untrusted sources until patched.
• Where possible, enforce file-type and dimension validation outside OpenImageIO; reject OpenEXR files whose width is not a multiple of the tile width when tile metadata is present.
• Run image-processing services and desktop tools under least-privilege accounts with constrained memory/CPU limits to reduce the impact of memory corruption.
• Isolate untrusted image processing in sandboxes, containers, or dedicated low-trust workstations.

2. Patch/upgrade steps:

• Upgrade OpenImageIO to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 (or later) as soon as the fixed releases are validated.
• Track the upstream GitHub repository and release notes for OpenImageIO to confirm the security fix.
• Rebuild any statically linked or vendored copies of OpenImageIO within third-party applications.

3. Long-term hardening:

• Implement fuzz testing of image parsers, including OpenEXR tiled images with partial edge tiles.
• Enforce strict input validation and bounds checking for all image decode paths.
• Monitor CVE feeds and apply defense-in-depth (ASLR, heap canaries, CFI) to reduce exploitability of memory corruption defects.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63422
• OpenImageIO GitHub repository and release notes (verify latest security fixes): https://github.com/AcademySoftwareFoundation/OpenImageIO
• CWE-122 Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• CVSS v3.1 Specification: https://www.first.org/cvss/specification-document
• CISA KEV Catalog (this CVE is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are identified for CVE-2026-63422 at this time. No public PoC, exploit code, or Nuclei template is available.