OpenImageIO 3.0.21.0 Security Update: Fixes for CVE-2026-63638, CVE-2026-65960, CVE-2026-63419

OpenImageIO v3.0.21.0 Security Update Summary Vulnerability Overview Version 3.0.21.0 of OpenImageIO fixes multiple security vulnerabilities affecting several image format parsing libraries (including the cinere, dpc, exr, gif, tiff, tga, png, post, and admin modules). Impact cinere: Validates that bit depths are within the library's supported range, rejecting corrupted files to prevent crashes (CVE-2026-63638) dpc: Fixes user-specified size validation and integer multiplication overflows involving guard values exr: Fixes an out-of-bounds write when reading EXR files with partial edge tiles where the tile dimensions are not multiples of the defined tile size gif: Handles error returns from gif_lib; avoids processing corrupted files and integer overflows tiff: Preserves RGB values for transparent pixels instead of zeroing them; prevents pixel overflows during TIFF-GIF palette splitting (CVE-2026-65960) tga: Prevents int32 overflows (CVE-2026-63419) post: Detects corrupted layer resolution and EOT bit-depth strings; fixes transparency handling when the transparent palette index is 0; prevents crashes from allocating non-playable ICC, Exif, or XMP blocks before validation; recovers non-playable blocks from corrupted data; validates color modes and fixes an out-of-bounds read reachable via the RawColor configuration property (CVE-2026-63635) png: Fixes an issue where the "tiff.hint" was applied only to the first file opencv: Adds support for OpenCV 5 and includes tests for standalone header files admin: Updates SECURITY.md and assigns new CVEs Remediation Individual modules have been patched to address their respective vulnerabilities; refer to the PRs/commits linked to each CVE number for specific fix details Users are advised to upgrade to version 3.1 as soon as possible (expected release within two months) POC/Exploit Code No POC or exploit code blocks are included in the referenced page.

Goal Reached Thanks to every supporter — we hit 100%!

OpenImageIO 3.0.21.0 Security Update: Fixes for CVE-2026-63638, CVE-2026-65960, CVE-2026-63419

More from this source