OpenImageIO versions before 3.0.18.0 and between 3.1.4.0-beta and 3.1.13.0 contain a bounds check error in the TGAInput::decode_pixel method. The vulnerability arises because the addition of an index (k) and palette bytes per pixel (palbytespp) uses unsigned 32-bit arithmetic that can wrap around, causing the bounds check to incorrectly pass. When k is 0xFFFFFFFC and palbytespp is 4, the sum wraps to 0, which is less than the palette allocation size, allowing the code to access the palette buffer using the unwrapped large index (0xFFFFFFFC). This results in an out-of-bounds read approximately 4 GB beyond the buffer, causing a segmentation fault (SEGV). The issue is addressed in OpenImageIO versions 3.0.18.0 and 3.1.13.0.

The vulnerability leads to an out-of-bounds read that causes a segmentation fault, resulting in denial of service (availability impact). There is no indication of confidentiality or integrity impact. Exploitation requires local access with user interaction and low privileges. No known exploits are reported in the wild.

A fix is available in OpenImageIO versions 3.0.18.0 and 3.1.13.0. Users should upgrade to these or later versions to remediate this vulnerability. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.