OpenImageIO TGA-to-GIF palette split overflow causing SIGSEGV (CVE-2025-65269)

Vulnerability Summary: TGA-to-GIF Palette Split Signed Overflow Leading to SIGSEGV Vulnerability Overview Vulnerability Name: TGA-to-GIF palette split signed overflow causes SIGSEGV CVE ID: CVE-2025-65269 Severity: Moderate (5.5 / 10) Root Cause: A signed integer overflow occurs in the GIF file outputter when calculating as , subsequently triggering an out-of-bounds read and ultimately resulting in a SIGSEGV crash. Trigger Condition: When converting a TGA image to GIF, a crash is triggered if an overflow occurs during palette split calculations. Affected Scope Affected Versions: v3.1.5.0, v3.0.20.0 Fixed Versions: >= 3.0.21.0, >= 3.1.16.0 Impact: Attackers can crash applications using OpenImageIO by crafting malicious TGA files (Denial of Service). CVSS v3 Metrics: Attack Vector: Local, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Unchanged, Confidentiality/Integrity/Availability Impact: None/None/High. Reproduction Code Expected Raw Binary Output: Optional Sanitizer Run: Root Cause Analysis During GIF file closure, OpenImageIO continues to write the pending initialized canvas, even after the TGA reader has reported EOF. The GIF file constructor subsequently calculates the split size using arithmetic: For the PoC, is 12,664,800. Multiplying this by 127 causes an overflow in the signed 32-bit , resulting in a negative value, which triggers an out-of-bounds read. Remediation In the GIF palette splitter, replace arithmetic with checked / arithmetic. Reject GIF output where the total palette count exceeds the safe range of the palette builder. Clear pending GIF frames or skip when input reading fails. PoC Archive Contents contains the following files: — Minimal 18-byte trigger — Product binary reproduction script — Latest non-signature raw binary reproduction output — v3 original GDB backtrace — main original GDB backtrace — Complete v3 ASAN log — Complete v3 UBSAN log — Complete main ASAN log — Complete main UBSAN log

Goal Reached Thanks to every supporter — we hit 100%!

OpenImageIO TGA-to-GIF palette split overflow causing SIGSEGV (CVE-2025-65269)

More from this source