CVE-2026-63638

OpenImageIO (a VFX/animation image I/O toolset) is vulnerable to a heap out-of-bounds write in its Cineon image reader. A crafted cineon file can declare an unsupported component bit depth of 26 ; cineoninput::open() maps it to a 32-bit ImageSpec, but libcineon maps the depth to an 8-byte value, ...

CVE-2026-63638 OpenImageIO: Cineon invalid bit depth heap out-of-bounds write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...