CVE-2026-63635

Executive Summary

CVE-2026-63635 is a global out-of-bounds read (CWE-125) in OpenImageIO, a widely used image I/O toolset for VFX and animation pipelines. A crafted Photoshop (PSD) file containing an invalid color_mode value bypasses normal validation when the oiio:rawcolor or psd:rawdata options are enabled, causing PSDInput::setup() to index fixed color-mode tables with attacker-controlled data and trigger an out-of-bounds read or bogus allocation. The impact is denial of service against applications and pipelines that parse untrusted PSD files; the CVSS score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), with availability as the sole affected security property.

Technical Analysis

OpenImageIO is a C++ library and toolset used across VFX, animation, and content-processing pipelines to read, write, and manipulate image files. The vulnerability is located in the PSD reader implementation at src/psd.imageio/psdinput.cpp, specifically in the PSDInput::validate_header() and PSDInput::setup() functions. The PSD file format header contains a color_mode field that determines how image channel data is interpreted. Per the NVD description, when a crafted PSD file supplies an invalid color_mode and either the oiio:rawcolor or psd:rawdata option is enabled, normal validation is bypassed.

The bypassed value is then used by PSDInput::setup() to index fixed color-mode lookup tables. Because the value is attacker-controlled and not constrained to the valid bounds of those tables, the indexing operation reads beyond the end of the fixed table — a global out-of-bounds read (CWE-125). The same unvalidated value feeds into mode_channel_count, which can drive a "bogus allocation" — an allocation size derived from invalid mode data — further contributing to denial-of-service conditions. The net effect is a crash or resource-exhaustion condition reachable purely through file parsing.

The root cause class is missing validation of a header field prior to its use as an array index and as a size determinant. The oiio:rawcolor and psd:rawdata options are relevant because they select code paths that consume the raw mode/color data directly rather than through the normal, validated interpretation path — effectively widening the attack surface for malformed headers.

The attack surface is any application, render farm, asset pipeline, or automation that calls OpenImageIO to open a PSD file supplied by an untrusted or semi-trusted source, with the relevant raw options enabled. Because parsing is a local file operation, the CVSS vector reflects local attack vector and user interaction (AV:L/UI:R), while privileges required are none (PR:N), confidentiality and integrity impacts are none (C:N/I:N), and availability impact is high (A:H).

Exploitation Scenarios

No public proof-of-concept code is reported in the provided intelligence (PoC status is "Public" as a category label, but no exploit code is confirmed; no Nuclei template exists). The attack chain is therefore described at the vulnerability-class level, strictly from the NVD description.

1. Reconnaissance / target identification. An adversary identifies a target that ingests PSD files through OpenImageIO — for example, a VFX studio render farm, a media asset management system, a batch conversion service, or an artist workstation that opens files received from external parties. Targets are selected where OpenImageIO is invoked with oiio:rawcolor or psd:rawdata enabled, since the vulnerability requires one of those options.

2. Triggering the flaw. The adversary crafts a PSD file whose header contains an invalid color_mode value. When the file is opened, PSDInput::validate_header() fails to reject the malformed mode in the raw color/data code path, and PSDInput::setup() subsequently uses the attacker-controlled color_mode value to index fixed color-mode tables. The invalid index produces a global out-of-bounds read; the same value influences mode_channel_count, which can yield a bogus allocation.

3. Payload / execution method. No memory-corruption write or code-execution primitive is described — the trigger is a malformed input file delivered through the normal asset-delivery channel (email attachment, shared storage, asset repository, upload portal). Delivery relies on the target user or automated pipeline opening the crafted PSD with the vulnerable options active; this is consistent with the required user interaction (UI:R) in the CVSS vector.

4. Post-exploitation impact. The primary outcome is denial of service: a crash of the parsing process or allocation-driven resource exhaustion. Because the out-of-bounds access is a read and the described consequence is a bogus allocation rather than a controlled write, the description supports availability impact only. On a render farm or shared processing host, a single crashing worker can disrupt a batch job, and repeated malicious files could repeatedly take down parsing services.

Impact Assessment

The CVSS base score is 5.5 (Medium), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. Subscore interpretation: attack vector Local (the file must be present on or delivered to the parsing host); attack complexity Low (no special conditions beyond enabling the raw options and supplying a malformed file); privileges required None; user interaction Required (a user or pipeline process must open the crafted file); scope Unchanged; confidentiality None; integrity None; availability High (crash or resource exhaustion). EPSS is 0.00201, at the 8.9th percentile of exploited CVEs, indicating a low current probability of exploitation in the wild. CVE-2026-63635 is not listed in CISA KEV, and no exploit code or Nuclei template is confirmed.

Business impact centers on availability of content-processing pipelines: render farms, transcoding services, asset ingestion systems, and artist workstations. Blast radius is limited to processes that parse the crafted PSD — there is no lateral movement or data-exfiltration impact described. However, because OpenImageIO is a foundational dependency embedded in many downstream tools and DCC (digital content creation) integrations, the true exposure depends on how many installed applications ship an affected version and whether they enable oiio:rawcolor or psd:rawdata. Repeated availability failures could delay production deadlines in time-sensitive VFX/animation workflows.

Detection Guidance

Sigma Rule

title: OpenImageIO PSD Invalid color_mode Out-of-Bounds Read Attempt
id: 8f4c1a2e-9d3b-4e77-a5c1-2b6e0f9a7c41
status: experimental
description: Detects OpenImageIO processes parsing PSD files where a crafted color_mode may trigger CVE-2026-63635 out-of-bounds read or bogus allocation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63635
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/oiiotool'
      - '/iconvert'
      - '/idiff'
      - '/oiioconvert'
  selection_ext:
    CommandLine|contains: '.psd'
  condition: selection_proc and selection_ext
falsepositives:
  - Legitimate PSD processing in VFX pipelines
level: low
tags:
  - attack.t1203
  - cve.2026.63635

YARA Rule

rule CVE_2026_63635_PSD_Invalid_ColorMode
{
    meta:
        description = "Detects PSD files with potentially invalid color_mode header values targeting OpenImageIO CVE-2026-63635"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63635"
        date = "2026-01-01"
        hash = "n/a"
    strings:
        $psd_magic = { 38 42 50 53 }   // "8BPS" PSD signature
    condition:
        $psd_magic at 0 and
        // PSD color_mode is the 2-byte big-endian field at offset 24.
        // Valid modes: 0=Bitmap,1=Grayscale,2=Indexed,3=RGB,4=CMYK,7=Multichannel,8=Duotone,9=Lab
        // Flag files whose mode is outside the valid range (0..9).
        ( uint16be(24) > 9 )
}

Suricata IDS Rule

alert file_data any any -> any any (msg:"CVE-2026-63635 OpenImageIO Crafted PSD Invalid color_mode Out-of-Bounds Read"; flow:established,to_server; file_data; content:"|38 42 50 53|"; depth:4; byte_test:2,>,9,24,relative,string,dec; reference:cve,2026-63635; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-63635; classtype:attempted-dos; sid:202663635; rev:1;)

Elastic Detection

process where process.name in ("oiiotool", "iconvert", "idiff", "oiioconvert")
  and process.args : "*.psd"

Splunk SPL Query

index=endpoint (process_name IN ("oiiotool","iconvert","idiff","oiioconvert"))
| where match(command_line, "(?i)\.psd")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, command_line
| where count > 0

Wazuh OSSEC Rule

<group name="openimageio,cve-2026-63635,">
  <rule id="100635" level="6">
    <if_sid>5500</if_sid>
    <field name="win.eventdata.image">oiiotool|iconvert|idiff|oiioconvert</field>
    <field name="win.eventdata.commandLine" type="pcre2">(?i)\.psd</field>
    <description>CVE-2026-63635: OpenImageIO parsing a PSD file - potential invalid color_mode OOB read</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — two independent sources, NVD and OSV, confirm the fix). No vendor workaround is provided in the supplied intelligence, and no fixed package versions are recorded in OSV (status shows unfixed for tracked package identifiers), so remediation is version-based.

1. Immediate mitigations. Update OpenImageIO to a fixed release (see below) as the primary control. Where immediate upgrade is not possible, disable the oiio:rawcolor and psd:rawdata options in any tooling or pipeline that processes PSD files, since the vulnerability requires one of these to be enabled. Restrict ingestion of PSD files from untrusted sources, and treat PSD files from external parties as untrusted input. Run parsing workloads under least privilege and with process isolation/resource limits so a crash or bogus allocation cannot escalate beyond availability impact.

2. Patch / upgrade steps. Upgrade to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 (or later within the respective release lines). Identify all installed copies of OpenImageIO — including bundled copies inside DCC applications and container images — using dependency scanning, then rebuild or redeploy downstream applications against the fixed library. Re-run ingestion pipelines and regression tests after upgrading.

3. Long-term hardening. Track OpenImageIO releases and subscribe to NVD/OSV advisories for the project. Adopt a dependency inventory for native image-parsing libraries, especially those embedded in third-party tools. Enforce input-validation review practices around header-field usage (bounds-checking before indexing lookup tables and before size derivations). Sandbox image parsing in containers with memory limits and crash-restart policies, and fuzz PSD/raw-color parsing paths as part of routine security testing.

References

• NVD — CVE-2026-63635: https://nvd.nist.gov/vuln/detail/CVE-2026-63635
• OSV — OpenImageIO package advisory entry (fix confirmed via OSV)
• OpenImageIO project repository and release notes for 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1: https://github.com/AcademySoftwareFoundation/OpenImageIO
• CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• No CISA KEV entry; no confirmed in-the-wild exploitation or named threat actor campaign is associated with CVE-2026-63635 in the provided intelligence. EPSS 0.00201 (8.9th percentile) indicates low exploitation likelihood.