--- Begin Message ---
Source: openimageio
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security
Hi,
The following vulnerabilities were published for openimageio.
CVE-2026-65969[0]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can
| leave a pending gif frame that is processed during output close.
| gifsplitpalette() computes numpixels multiplied by the palette
| partition width in signed 32-bit arithmetic; a large image overflows
| that intermediate, corrupts subpixelsa, and drives an out-of-bounds
| read while building the gif palette, resulting in a process crash
| and denial of service. The affected implementation is identified by
| src/gif.imageio/gif.h, GifSplitPalette(), numPixels, subPixelsA,
| GIFOutput, and truncated TGA input, which define the relevant source
| path, functions, state, and trigger. This issue is fixed in versions
| 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9mwc-fjgj-8wmq
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5292
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/134977da625a84fc5a09a34321806f1fe0093c24
(v3.2.0.3-beta1)
CVE-2026-63638[1]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon
| image can declare unsupported component bit depth 26.
| cineoninput::open() maps it to a 32-bit imagespec, but libcineon
| maps the unsupported depth to an 8-byte value, so
| cineoninput::read_native_scanline() causes attacker-controlled data
| to be written beyond the 4-byte-per-pixel caller buffer, resulting
| in a heap out-of-bounds write and memory corruption. The affected
| implementation is identified by src/cineon.imageio/cineoninput.cpp,
| CineonInput::open(), CineonInput::read_native_scanline(),
| ComponentDataSize(), bit depth 26, and ImageSpec, which define the
| relevant source path, functions, state, and trigger. This issue is
| fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9hxv-jvgr-3x8g
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5283
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/6f2b2e85b3b3933ccc5a46303d5535f99bfa39fb
(v3.2.0.3-beta1)
CVE-2026-63635[2]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with
| an invalid color_mode bypasses normal validation when oiio:rawcolor
| or psd:rawdata is enabled. psdinput::setup() then uses the attacker-
| controlled value to index fixed color-mode tables, causing a global
| out-of-bounds read and potentially a bogus allocation, resulting in
| denial of service. The affected implementation is identified by
| src/psd.imageio/psdinput.cpp, PSDInput::validate_header(),
| PSDInput::setup(), oiio:RawColor, psd:RawData, color_mode, and
| mode_channel_count, which define the relevant source path,
| functions, state, and trigger. This issue is fixed in versions
| 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3c8w-9xvm-r6gf
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5282
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/50481b0f90932a4675f65f3cc26407139cb9e20e
(v3.2.0.3-beta1)
CVE-2026-63422[3]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled
| openexr image whose width is not a multiple of its tile width can
| trigger an overflow when a caller reads a partial edge-tile
| rectangle. openexrinput::read_native_tiles() copies each row into
| the caller buffer using the padded whole-tile scanline_stride rather
| than user_scanline_bytes for the requested rectangle, resulting in a
| heap out-of-bounds write and memory corruption. The affected
| implementation is identified by src/openexr.imageio/exrinput.cpp,
| OpenEXRInput::read_native_tiles(), partial edge tile,
| user_scanline_bytes, and scanline_stride, which define the relevant
| source path, functions, state, and trigger. This issue is fixed in
| versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh5r-whph-qmc5
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5295
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/7303134f13b0f9dc738b8ecabecd8c9f90cbd4c9
(v3.2.0.3-beta1)
CVE-2026-63420[4]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with
| transparency metadata creates fewer stored channel_buffers than the
| spec.nchannels value advertised by the rawcolor path. when
| oiio:rawcolor or psd:rawdata is enabled,
| psdinput::read_native_scanline() passes spec.nchannels to
| psdinput::interleave_row(), which indexes beyond channel_buffers,
| resulting in a heap out-of-bounds read and process crash. The
| affected implementation is identified by
| src/psd.imageio/psdinput.cpp, PSDInput::read_native_scanline(),
| PSDInput::interleave_row(), oiio:RawColor, psd:RawData,
| channel_buffers, and spec.nchannels, which define the relevant
| source path, functions, state, and trigger. This issue is fixed in
| versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5307
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/4995b25b8216552630e0aee0d8870e0d3aaae7ee
(v3.2.0.3-beta1)
CVE-2026-63419[5]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled
| iff is exposed with a 16-bit public imagespec while the decoder
| retains a 32-bit internal pixel size. iffinput::read_native_tile()
| copies according to m_header.pixel_bytes() rather than
| imagespec::tile_bytes(true), and a failed read can leave m_buf
| nonempty so a later call copies partially initialized data into the
| undersized caller buffer, resulting in a heap out-of-bounds write
| and memory corruption. The affected implementation is identified by
| src/iff.imageio/iffinput.cpp, IffInput::read_native_tile(),
| ImageSpec::tile_bytes(true), m_header.pixel_bytes(), ZBUFFER, and
| m_buf, which define the relevant source path, functions, state, and
| trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and
| 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-w6wc-gcf4-5pj2
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5268
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/9cda48b150294c7f024e680a6c9b0402e50f4816
(v3.2.0.3-beta1)
CVE-2026-59956[6]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, An uncompressed
| 16-bit iff image with a z-buffer makes iffinput::readimg() allocate
| a temporary scanline from m_header.rgba_count but copy from it using
| m_header.pixel_bytes(), whose stride also includes z-buffer bytes.
| the oversized memcpy reads beyond the temporary heap buffer and
| copies adjacent memory into the output image, resulting in a crash
| or disclosure of adjacent heap data. The affected implementation is
| identified by src/iff.imageio/iffinput.cpp, IffInput::readimg(),
| m_header.rgba_count, and m_header.pixel_bytes(), which define the
| relevant source path, functions, state, and trigger. This issue is
| fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-hjfv-gvxc-qgvh
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5251
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/f01bd16764b2a06f372899e3e302280a7f9c8c02
(v3.2.0.3-beta1)
CVE-2026-59181[7]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted cineon
| file can supply a numberofelements value greater than the format
| maximum of eight. cineoninput::open() uses that unchecked value as
| the loop bound while filling the fixed strings[8] array, writing
| pointers beyond the stack buffer and into adjacent state, resulting
| in memory corruption and denial of service. The affected
| implementation is identified by src/cineon.imageio/cineoninput.cpp,
| CineonInput::open(), numberOfElements, and strings[8], which define
| the relevant source path, functions, state, and trigger. This issue
| is fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh8r-vmqq-56pp
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5250
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/908f22f5528e88e5e96184c194caa26b54b2b85f
(v3.2.0.3-beta1)
CVE-2026-59156[8]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits
| stream containing consecutive 2880-byte header blocks without the
| mandatory end keyword makes fitsinput::read_fits_header() call
| itself without a depth bound. repeated recursive parsing exhausts
| the application stack, resulting in denial of service. The affected
| implementation is identified by src/fits.imageio/fitsinput.cpp,
| FitsInput::read_fits_header(), END keyword, and 2880-byte FITS
| header blocks, which define the relevant source path, functions,
| state, and trigger. This issue is fixed in versions 3.0.20.0,
| 3.1.15.0, and 3.2.0.3-beta1.
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xvwr-x6ch-v2fq
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5248
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/b0de7d40d06eb4abc7ef14c1321a1a2a976d8c1c
(v3.2.0.3-beta1)
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-65969
https://www.cve.org/CVERecord?id=CVE-2026-65969
[1] https://security-tracker.debian.org/tracker/CVE-2026-63638
https://www.cve.org/CVERecord?id=CVE-2026-63638
[2] https://security-tracker.debian.org/tracker/CVE-2026-63635
https://www.cve.org/CVERecord?id=CVE-2026-63635
[3] https://security-tracker.debian.org/tracker/CVE-2026-63422
https://www.cve.org/CVERecord?id=CVE-2026-63422
[4] https://security-tracker.debian.org/tracker/CVE-2026-63420
https://www.cve.org/CVERecord?id=CVE-2026-63420
[5] https://security-tracker.debian.org/tracker/CVE-2026-63419
https://www.cve.org/CVERecord?id=CVE-2026-63419
[6] https://security-tracker.debian.org/tracker/CVE-2026-59956
https://www.cve.org/CVERecord?id=CVE-2026-59956
[7] https://security-tracker.debian.org/tracker/CVE-2026-59181
https://www.cve.org/CVERecord?id=CVE-2026-59181
[8] https://security-tracker.debian.org/tracker/CVE-2026-59156
https://www.cve.org/CVERecord?id=CVE-2026-59156
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: openimageio
Source-Version: 3.1.18.0+dfsg-1
Done: Sébastien Noel <[email protected]>
We believe that the bug you reported is fixed in the latest version of
openimageio, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sébastien Noel <[email protected]> (supplier of updated openimageio package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 05 Oct 2026 09:19:17 +0200
Source: openimageio
Binary: libopenimageio-dev libopenimageio-doc libopenimageio3.1
libopenimageio3.1-dbgsym openimageio-tools openimageio-tools-dbgsym
python3-openimageio python3-openimageio-dbgsym
Architecture: source amd64 all
Version: 3.1.18.0+dfsg-1
Distribution: experimental
Urgency: medium
Maintainer: Debian PhotoTools Maintainers
<[email protected]>
Changed-By: Sébastien Noel <[email protected]>
Description:
libopenimageio-dev - Library for reading and writing images - development
libopenimageio-doc - Library for reading and writing images - documentation
libopenimageio3.1 - Library for reading and writing images - runtime
openimageio-tools - Library for reading and writing images - command line tools
python3-openimageio - Library for reading and writing images - Python bindings
Closes: 1094410 1094411 1135382 1139915 1148554
Changes:
openimageio (3.1.18.0+dfsg-1) experimental; urgency=medium
.
* Team upload.
.
[ Sébastien Noel ]
* New upstream release, addressing the following security issues:
- CVE-2024-55193: NULL pointer dereference (Closes: #1094411)
- CVE-2024-55194: Heap overflow (Closes: #1094410)
- CVE-2026-7582: Out-of-bounds write (Closes: #1135382)
- CVE-2026-43903, CVE-2026-43904, CVE-2026-43905, CVE-2026-43906,
CVE-2026-43907, CVE-2026-43908, CVE-2026-43909, CVE-2026-43996
(Closes: #1139915)
- CVE-2026-65969, CVE-2026-63638, CVE-2026-63635, CVE-2026-63422,
CVE-2026-63420, CVE-2026-63419, CVE-2026-59956, CVE-2026-59181,
CVE-2026-59156 (Closes: #1148554)
* Update package name to match soname bump:
- libopenimageio2.5 → libopenimageio3.1
* Switch Build-Depends from Qt5 to Qt6
* Add Build-Depends on libjxl-dev
* Cleanup d/copyright
.
[ Antoine Lassagne ]
* Enable python autopkgtests
Checksums-Sha1:
3a39df62f5068cf5a24685d7b78f900943484720 2539 openimageio_3.1.18.0+dfsg-1.dsc
9f36a9eafbd0f0ce8c1feca37b201a6bf0280ce9 47428552
openimageio_3.1.18.0+dfsg.orig.tar.xz
2c6e9ed2003d8dcab99f8c436b9b5f5e84a633f7 18716
openimageio_3.1.18.0+dfsg-1.debian.tar.xz
70e30d3498cf6d70c2ecf844dcc76371545a88b9 498452
libopenimageio-dev_3.1.18.0+dfsg-1_amd64.deb
f280a0131791431f172b81321d0194588c0c10a0 302448
libopenimageio-doc_3.1.18.0+dfsg-1_all.deb
7e9dd5223a83ae369e224177be6667ee9ebd0940 56471300
libopenimageio3.1-dbgsym_3.1.18.0+dfsg-1_amd64.deb
088d6eb9017c20504f8f6fb310720c7580919c38 2780320
libopenimageio3.1_3.1.18.0+dfsg-1_amd64.deb
da464b2547f988fe5a5287f249da6b92aab4bf65 14986400
openimageio-tools-dbgsym_3.1.18.0+dfsg-1_amd64.deb
f89861f49d9406cbbabb4d21bc30aa88c4441ab2 799152
openimageio-tools_3.1.18.0+dfsg-1_amd64.deb
07933c2dc353d7443de151ab8ebf363c8ab7dc80 25123
openimageio_3.1.18.0+dfsg-1_amd64.buildinfo
09e92c6264d0202c6d3af8804c5ff16fbbe79cbb 12184364
python3-openimageio-dbgsym_3.1.18.0+dfsg-1_amd64.deb
639f243ae49e87dbfe399a57fc5711491f645006 689764
python3-openimageio_3.1.18.0+dfsg-1_amd64.deb
Checksums-Sha256:
981c04885a900eca955afccea2a85abaa7f0aeb4b3559ecdfc3cea232d35a94c 2539
openimageio_3.1.18.0+dfsg-1.dsc
394817371fda03656b61ef4e7e160b687023106023092f1deba3c891292029ae 47428552
openimageio_3.1.18.0+dfsg.orig.tar.xz
a8ec541a50a3762034d515da0ec75c478fa28299974db5377f33c1e883294a73 18716
openimageio_3.1.18.0+dfsg-1.debian.tar.xz
70cba4693df565b44e867623ef17dea358cc28c8f83182cccc2bb11e5928c69c 498452
libopenimageio-dev_3.1.18.0+dfsg-1_amd64.deb
c4d7c401b54e0fd04cc840652e3b0719310800a1293576bbcdd334de8ab1aa0f 302448
libopenimageio-doc_3.1.18.0+dfsg-1_all.deb
19cc5b68c11cb96372eae388b26726ec119d1aa2b9e7dfcdd6230f97eb02c5f3 56471300
libopenimageio3.1-dbgsym_3.1.18.0+dfsg-1_amd64.deb
fe51387d47f37504ea4bd7f133b6fa5d5d9a737214f6437572f9194419c60315 2780320
libopenimageio3.1_3.1.18.0+dfsg-1_amd64.deb
7937f83c9ebda48d6a7e62822f045762c23f5d05aad3cba307f1e70f02ddb86b 14986400
openimageio-tools-dbgsym_3.1.18.0+dfsg-1_amd64.deb
9c72be594758073947190700250d45fe000b7b059a39785a0edcf946a1fd3307 799152
openimageio-tools_3.1.18.0+dfsg-1_amd64.deb
8d9da87c24c156669fb901d0a9d965c78a9d5c424c8e315a4a951bd755024f15 25123
openimageio_3.1.18.0+dfsg-1_amd64.buildinfo
f2633c528511fa957c23b33639bbe20012f07964bfebe134bccf8713cb261831 12184364
python3-openimageio-dbgsym_3.1.18.0+dfsg-1_amd64.deb
6a694e91e1534f040c314708591ad9a94d06f3dff5a937d225e4310b1cead4f9 689764
python3-openimageio_3.1.18.0+dfsg-1_amd64.deb
Files:
0bb58277913c65a43ff800155c1ed553 2539 libs optional
openimageio_3.1.18.0+dfsg-1.dsc
138f185e31e22c5acafbb3d170416493 47428552 libs optional
openimageio_3.1.18.0+dfsg.orig.tar.xz
22e1292ff18d1054cdc68c95d5536f0e 18716 libs optional
openimageio_3.1.18.0+dfsg-1.debian.tar.xz
4419728263f26550db15561b021603d1 498452 libdevel optional
libopenimageio-dev_3.1.18.0+dfsg-1_amd64.deb
88b14a8cadc5d86cfc5a2879556a837c 302448 doc optional
libopenimageio-doc_3.1.18.0+dfsg-1_all.deb
1bebd7e5e629d01f4fe437930b26f0b6 56471300 debug optional
libopenimageio3.1-dbgsym_3.1.18.0+dfsg-1_amd64.deb
57bfd260b292a4764284abd632697920 2780320 libs optional
libopenimageio3.1_3.1.18.0+dfsg-1_amd64.deb
78fc885c2becac920558bc4128d5d9eb 14986400 debug optional
openimageio-tools-dbgsym_3.1.18.0+dfsg-1_amd64.deb
3bf46f6b75d5949ac42722975efc4000 799152 graphics optional
openimageio-tools_3.1.18.0+dfsg-1_amd64.deb
15704099cfe99bf6f0867bfaa5845a31 25123 libs optional
openimageio_3.1.18.0+dfsg-1_amd64.buildinfo
ba5a47416e7740d5da06c2ef9dc1b801 12184364 debug optional
python3-openimageio-dbgsym_3.1.18.0+dfsg-1_amd64.deb
c53125cfc98c4437831d6594cd33dec8 689764 python optional
python3-openimageio_3.1.18.0+dfsg-1_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQFHBAEBCgAxFiEEdlP6my3wO8aMe9FCrKAIuMk0p9QFAmrDVAQTHHR3b2xpZmVA
ZGViaWFuLm9yZwAKCRCsoAi4yTSn1E7FB/9uBj2LILpzhvatJIHCd3EoiSeVZqH2
5uk/diElZclNOk/LEIVFftFSycaWIYQ/mj2+0qMSGLrsTNFBSXULdKZoDQisiaUf
Vt/w+QueoBwdGYcDGFnkk6wA6DDWme+Fb2ZzFYmrZoQBuEpgytPWQc0ohiklHh4N
B0iRD/kwpJw5e1tvNTjCNOle0KuQ63+jk7gusIEtJZAvppsz/ubElCT8RcmWPG6o
gfTq++ESjIVx2UIwKPJlN7k6WrLFw8/JLNxLn8QQGVwcBH1W1Bac1OXMP8A9RhaX
vuR97bvVDCVvrURtd+x0ReYMfQwdPWM+h8EHNjgKOAhqYZ+w2kzlO1sR
=I41R
-----END PGP SIGNATURE-----
pgpl4nC6A2Zva.pgp
Description: PGP signature
--- End Message ---
