The vulnerability is an integer wraparound in the bounds check of TGAInput::decode_pixel in OpenImageIO. When an attacker provides a TGA file with a palette index of 0xFFFFFFFC and a palette of 4 bytes per entry, the unsigned arithmetic overflow turns the sum into zero, passing the bounds check. The decoder then reads memory at offset 0xFFFFFFFC from the palette buffer, which is approximately 4 GB past the buffer’s start, causing an out‑of‑bounds read and a segmentation fault. The impact is a denial‑of‑service as the application or dependent process will crash when processing the malicious image. This flaw is identified as CWE‑125: Out‑of‑bounds Read.

The issue affects the OpenImageIO toolset released by the AcademySoftwareFoundation. Versions prior to 3.0.18.0 and 3.1.13.0 are vulnerable. All builds that include the TGA paletted image decoder and do not apply the correction in those releases are affected.

The CVSS base score of 5.5 indicates medium severity. EPSS is not available, so a probability estimate is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by supplying a crafted TGA file; the vector is most likely remote if the OpenImageIO library is part of a network‑serviced application, or local if an unprivileged user can instruct the program to read an arbitrary file. The attack does not provide code execution but can be used to crash the target to achieve denial of service or to observe memory contents if the read leaks information. No special prerequisites beyond providing an untrusted TGA image are required.