OpenImageIO versions before 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1 contain a heap out-of-bounds read vulnerability in the PSD input plugin. When an indexed PSD file with transparency metadata is processed with oiio:rawcolor or psd:rawdata enabled, the function psdinput::read_native_scanline() passes a channel count (spec.nchannels) to psdinput::interleave_row() that exceeds the number of allocated channel_buffers. This results in out-of-bounds memory access and a process crash. The vulnerability is located in the source code at src/psd.imageio/psdinput.cpp within the PSDInput class methods read_native_scanline() and interleave_row(). The issue is resolved in OpenImageIO versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

The vulnerability causes a heap out-of-bounds read which leads to a process crash, resulting in denial of service. There is no indication of confidentiality or integrity impact. The CVSS 3.1 base score is 5.5 (medium severity), reflecting local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Upgrade OpenImageIO to version 3.0.21.0 or later, 3.1.16.0 or later, or 3.2.0.3-beta1 or later to apply the official fix for this vulnerability. No other mitigations are indicated or necessary.