CVE-2026-65969

Executive Summary

CVE-2026-65969 is an integer-overflow-driven out-of-bounds read (CWE-125) in OpenImageIO, a widely used image processing toolset for VFX, animation, and asset pipelines. The flaw resides in the GIF encoder path (gifsplitpalette()) and is triggered when a truncated TGA input leaves a pending GIF frame that is processed during output close, causing a process crash and denial of service. Rendering farms, asset-pipeline services, and any workload that transcodes untrusted TGA-to-GIF image input using affected versions prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 are in scope.

Technical Analysis

OpenImageIO reads, writes, and manipulates image files across formats used in VFX and animation. This vulnerability is an interaction defect between two codecs: TGA decoding and GIF encoding. The NVD description states that "a truncated tga can leave a pending gif frame that is processed during output close." In other words, a malformed/incomplete TGA file that does not fully decode still results in a pending frame being carried into the GIF output stage, where gifsplitpalette() later operates on it.

The core defect is a signed 32-bit integer overflow. The affected implementation is identified by src/gif.imageio/gif.h, GifSplitPalette(), numPixels, subPixelsA, and GIFOutput, per the description. gifsplitpalette() computes numpixels multiplied by the palette partition width in signed 32-bit arithmetic. For a sufficiently large image, that intermediate multiplication overflows the signed 32-bit integer, corrupting subPixelsA and producing an incorrect index/bounds value. When the GIF palette is subsequently built, the corrupted value drives an out-of-bounds read — the process reads past the end of an allocation, causing a crash and denial of service.

Two conditions combine:

1. Integer overflow in palette partition sizing — a large image causes numpixels × width to exceed the signed 32-bit range in gifsplitpalette().
2. Unexpected processing of an incomplete frame — a truncated TGA leaves a pending frame that is finalized during output close, ensuring the overflow-prone path executes on attacker-influenced dimensions.

Impact per CVSS is fail-stop: Confidentiality None, Integrity None, Availability High (C:N/I:N/A:H), with local attack vector, low complexity, no privileges, and user interaction required (AV:L/AC:L/PR:N/UI:R/S:U). There is no public PoC, no Nuclei template, and the patch-confidence metric from tracked sources is 0/4 (UNPATCHED), meaning no tracked source has evidenced a vendor fix even though fixed versions are named in the description.

Attack surface: image ingestion/transcoding pipelines — batch conversion services, thumbnail generators, media asset management ingestion, and any automation that converts TGA to GIF with untrusted files. The trigger is a crafted image file rather than a network packet, so the surface is file-based.

Exploitation Scenarios

No public PoC available; attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/target identification. Identify services and pipelines that accept user-supplied images and convert or transcode formats — specifically any path that can take TGA input and emit GIF output using OpenImageIO. Candidate targets include asset-ingest endpoints, rendering-farm submission portals, DAM/MAM ingestion workers, and CI/CD media jobs. An attacker confirms the target uses an affected OpenImageIO version (prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1) through response behavior, version banners, public documentation, or job configuration leakage.

2. Triggering the flaw class. The attacker supplies a truncated TGA file. Truncation is what causes the TGA decode to leave a pending GIF frame; that frame is then processed during output close. The crafted file must additionally carry image dimensions large enough that the numpixels × palette partition width computation in gifsplitpalette() overflows signed 32-bit arithmetic. The description does not disclose a precise dimension threshold, so no specific value is asserted here.

3. Payload/execution method (vulnerability-class level). The payload is the malformed image itself — no code injection is needed. Delivery is via whatever ingestion channel the target exposes (file upload, watched folder, shared asset library, API image-processing request). When OpenImageIO converts the TGA to GIF, the overflow corrupts subPixelsA, and the subsequent GIF palette build performs an out-of-bounds read. The attacker does not need local access to stage the overflow; the crafted file is processed inside the victim's converter.

4. Post-exploitation impact. The immediate outcome is a process crash — the converter, worker, or service aborts, yielding denial of service. Because C/I are rated None, the described impact is limited to availability: disruption of image-processing throughput, failed render/transcode jobs, queue backlogs, or repeated restarts if the attacker can re-submit the file. There is no described memory-write primitive in the given data, so this should be treated as a crash/DoS issue rather than a code-execution chain, though OOB reads in C++ components can be crash-adjacent and should be reviewed independently.

Impact Assessment

CVSS 3.1 base score is 5.5 (Medium): CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

• Availability (A:H) is the dominant subscore — a reliably triggerable crash degrades processing capacity.
• Confidentiality and Integrity (C:N/I:N) — the described primitive is an out-of-bounds read that corrupts internal state (subPixelsA) and crashes; no data exfiltration or write primitive is described.
• Attack Vector (AV:L) / User Interaction (UI:R) — exploitation is file-mediated; the affected process must be induced to open and convert the malicious TGA. On a server-side batch converter, this "interaction" may simply be a file arriving in the ingest path, which widens practical reach.
• Complexity (AC:L) / Privileges (PR:N) — a low-complexity, unauthenticated crafted file.

Blast radius: shared render farms, media gateways, and multi-tenant asset services can propagate a single malformed file into many downstream jobs, amplifying availability loss. Because it is a local/file vector, internet exposure alone is not required — internal distribution channels for assets are enough. No CISA KEV listing, no EPSS score (not yet scored by FIRST.org), no public exploit, and no Nuclei template.

Detection Guidance

Sigma Rule

title: OpenImageIO GIF Encoder Out-of-Bounds Read via Truncated TGA (CVE-2026-65969)
id: 7b1e9c2a-4f3d-4a6b-9e21-0c5f8d2a1b77
status: experimental
description: Detects crash of image-processing processes that load OpenImageIO GIF/TGA codecs, consistent with CVE-2026-65969
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65969
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_image:
    Image|endswith:
      - '/oiiotool'
      - '/iconvert'
      - '/idiff'
  selection_crash:
    CommandLine|contains: 'tga'
  condition: selection_image and selection_crash
fields:
  - Image
  - CommandLine
  - ParentImage
falsepositives:
  - Legitimate TGA conversion workloads
level: medium

YARA Rule

rule EXPL_CVE_2026_65969_Truncated_TGA_GIF_OOB
{
    meta:
        description = "Detects truncated TGA files that may trigger CVE-2026-65969 GIF palette out-of-bounds read in OpenImageIO"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65969"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $tga_new = { 00 00 02 00 00 00 00 00 00 00 00 00 }
        $tga_rle = { 00 00 0A 00 00 00 00 00 00 00 00 00 }

    condition:
        (uint8(0) == 0x00) and
        (uint8(1) == 0x00) and
        ((uint8(2) == 0x02) or (uint8(2) == 0x0A) or (uint8(2) == 0x03)) and
        (uint8(16) == 0x08) and
        (filesize < 20480)
}

Suricata IDS Rule

alert http any any -> any any (msg:"valtersit.com - CVE-2026-65969 OpenImageIO truncated TGA to GIF OOB read attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"|00 00 02 00|"; depth:0; content:"|00 00 00 00 00 00|"; byte_test:4,>,1000,12,relative,little; classtype:attempted-dos; reference:cve,2026-65969; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65969; metadata:service http, created_at 2026_01_01, created_by valtersit.com; sid:2026659690; rev:1;)

Note: detect truncated TGA uploads and resulting 5xx/crash behavior at the application layer where byte-accurate signatures are impractical; the rule above is a starting heuristic and should be tuned to the target's ingest format.

Elastic Detection

process where event.type == "start" and
  process.name in ("oiiotool", "iconvert", "idiff") and
  process.command_line : "*tga*" and
  not process.parent.name in ("make","ninja","cmake")

Pair with a companion signal for abnormal process termination of the same binary within a short window to catch the crash-loop pattern:

sequence by host.id, process.entity_id with maxspan=30s
  [process where process.name in ("oiiotool","iconvert") and process.command_line : "*tga*"]
  [process where event.type == "end" and process.exit_code != 0]

Splunk SPL Query

index=main (sourcetype=syslog OR sourcetype=linux_secure OR sourcetype=application)
| search ("oiiotool" OR "iconvert" OR "OpenImageIO" OR "gif.imageio" OR "gifsplitpalette")
| rex field=_raw "(?<img_ext>\.(tga|gif))"
| stats count min(_time) as firstTime max(_time) as lastTime values(img_ext) as ext by host, process
| where (ext=".tga" OR ext=".gif") AND count > 3
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="openimageio,cve-2026-65969,">
  <rule id="2026659" level="6">
    <decoded_as>json</decoded_as>
    <field name="name">oiiotool|iconvert|idiff</field>
    <regex type="pcre2">(?i)\.tga</regex>
    <description>CVE-2026-65969: OpenImageIO processing TGA input - potential GIF palette OOB read/DoS</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
  <rule id="2026660" level="10">
    <if_sid>2026659</if_sid>
    <regex type="pcre2">(?i)(segfault|core dumped|SIGSEGV|signal 11)</regex>
    <description>CVE-2026-65969: OpenImageIO process crashed while converting TGA to GIF - possible exploitation</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Although the NVD description names fixed versions (3.0.21.0, 3.1.16.0, 3.2.0.3-beta1), no tracked patch source corroborates a vendor fix artifact. Treat as unpatched until a signed vendor release/advisory is verified.

1. Immediate mitigations

   • Restrict who and what can submit TGA (and image files generally) into OpenImageIO-backed conversion pipelines; require authentication on any ingest endpoint.
   • Quarantine or reject truncated TGA inputs at the perimeter (size/structure validation) before they reach the converter.
   • Run converters in containers with memory limits and auto-restart/backoff so a crash cannot cascade; isolate workers per tenant.
   • Enforce resource limits (ulimit, cgroups) and disable unused codecs where feasible.
   • Monitor for repeated converter crashes as an exploitation indicator (see rules above).

2. Patch/upgrade steps

   • If a fixed build is verifiable from the upstream project, upgrade to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 (matching your release train) and validate the fix in a test converter using malformed TGA inputs.
   • Because patch confidence is 0/4, independently confirm the fix by reviewing the upstream diff for src/gif.imageio/gif.h / GifSplitPalette() and rebuilding from source if necessary.
   • Track the NVD record and upstream repository for an official advisory before declaring remediation complete.

3. Long-term hardening

   • Add fuzzing for the TGA decode → GIF encode path, with emphasis on truncated inputs and large dimensions.
   • Mandate bounds-checked arithmetic (widened integer types or explicit overflow checks) in palette-size computations.
   • Adopt a "convert in disposable sandbox" architecture so any single malformed file crash is contained.
   • Subscribe to OpenImageIO security announcements and incorporate converter crash telemetry into SOAR playbooks.

References

1. NVD — CVE-2026-65969: https://nvd.nist.gov/vuln/detail/CVE-2026-65969
2. OpenImageIO project (upstream source and releases): https://github.com/AcademySoftwareFoundation/OpenImageIO
3. CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
4. CISA Known Exploited Vulnerabilities catalog (not listed — verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (no score published at time of writing): https://www.first.org/epss/

Evidence status: no public PoC, no exploit code, no Nuclei template, no CISA KEV listing, and no EPSS score. No threat-actor campaign is associated with this CVE in the data provided.