CVE-2026-84448 libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

CVE-2026-84448

libheif , a HEIF and AVIF file format decoder/encoder, contains a heap out-of-bounds read in its region writer API prior to version 1.23.2 . The function heif_region_item_add_region_inline_mask_data() in heif_regions.cc accepts a mask_data_len parameter without verifying it matches the byte count...

CVE-2026-84448 libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

EUVD-2026-83137

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette computes numpixels...

CVE-2026-65969 OpenImageIO: TGA-to-GIF palette split signed overflow causes SIGSEGV

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette computes numpixels...

CVE-2026-65969

OpenImageIO (a toolset for reading, writing, and manipulating image files used in VFX/animation) is affected by a signed 32-bit integer overflow in GifSplitPalette() (src/gif.imageio/gif.h). A truncated TGA input can leave a pending GIF frame that is processed during output close; the multiplicat...

CVE-2026-65969 OpenImageIO: TGA-to-GIF palette split signed overflow causes SIGSEGV

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette computes numpixels...

EUVD-2026-83134

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer...

CVE-2026-67549

OpenImageIO is a toolset for reading, writing, and manipulating image files used in VFX/animation. Prior to 3.1.16.0 , a crafted 1-bit contiguous CMYK TIFF triggers a heap out-of-bounds write in tiffinput::bit_convert() (src/tiff.imageio/tiffinput.cpp). The bug occurs because a native uint1 Image...

CVE-2026-67549 OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer...

CVE-2026-67549 OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer...

CVE-2026-66493

Path Traversal in File Operations Delete / Copy / Move PhocaCommander ≤ 6.1.3 — Authenticated Admin Manipulates Files Outside Webroot SUMMARY The file action handler in PhocaCommander constructs source and destination paths from attacker-controlled base64-encoded parameters pathfrom, pathwhere...

CVE-2026-63638 OpenImageIO: Cineon invalid bit depth heap out-of-bounds write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

CVE-2026-63638

OpenImageIO (a VFX/animation image I/O toolset) is vulnerable to a heap out-of-bounds write in its Cineon image reader. A crafted cineon file can declare an unsupported component bit depth of 26 ; cineoninput::open() maps it to a 32-bit ImageSpec, but libcineon maps the depth to an 8-byte value, ...

EUVD-2026-83132

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

CVE-2026-63638 OpenImageIO: Cineon invalid bit depth heap out-of-bounds write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

EUVD-2026-83130

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel...

CVE-2026-63419

OpenImageIO (a VFX/animation image I/O toolset) is vulnerable to a heap out-of-bounds write in its IFF image format plugin when processing zbuffer-only tiled files. The root cause is a mismatch between a 16-bit public imagespec and the decoder's 32-bit internal pixel size: IffInput::read_native_t...

CVE-2026-63419 OpenImageIO: IFF ZBUFFER tile read writes past caller tile buffer

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel...

CVE-2026-63419 OpenImageIO: IFF ZBUFFER tile read writes past caller tile buffer

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel...