v3.1.16.0

Release 3.1.16.0 (Aug 1, 2026) -- compared to 3.1.15.0

• oiiotool: Add thumbnail get/set commands and fix TGA thumbnail I/O. #5236 (by @jinhgkim / Jinnie Kim)
• api: Add "limits:resolution" global attribute to cap per-dimension image size, used for guarding against decompression-bomb attacks. #5297 (by @lgritz / Larry Gritz)
• testing: Add libFuzzer-based fuzzing infrastructure for format readers. #5314
• texture: Experimental GPU texture system prototype, implemented as a standalone testsuite executable (does not modify the core library). #5228 (by @aconty / Alejandro Conty)
• bmp: Validate scanline file position before reading, guarding against corrupt files. #5274
• cineon: Validate bit depth against libcineon's supported set, fixing a heap out-of-bounds write on invalid bit depths. #5283 (CVE-2026-63638)
• dds: Reject corrupt bytes-per-pixel before it forces a huge allocation, and clamp pixel memcpy to sizeof(uint32_t) to prevent stack overflow. #5286 #5287
• dpx: Detect corrupt userbuf size with an overflow guard, and fix a heap overflow in 1-channel 10-bit filled scanline swap. #5271 #5298
• exif: Beef up Exif error detection for corrupt or malformed blocks (affects all formats that embed Exif). #5322
• exr: Use rectangle row stride for partial edge tile reads, fixing a heap out-of-bounds write. #5295 (CVE-2026-63422)
• exr: Add check_open() guard to the exrinput_c C API. #5280
• ffmpeg: Align swscale output buffers. #5301 (by @br0nzu / Dongju Lee)
• filesystem: Overflow-safe bounds check in IOMemReader::pread. #5262
• gif: Handle empty error from gif_lib, and address corrupt files with bad resolutions and int overflow. #5269 #5257
• gif, targa: Avoid int32 overflow in palette-split pixel-count math and reject implausible image dimensions before allocating, fixing a signed overflow that could crash TGA-to-GIF conversion. #5292 #5293 (CVE-2026-65969)
• gif: Guard canvas index overflow. #5299 (by @br0nzu / Dongju Lee)
• hdr: Validate resolution to detect corrupted files, and resolve a format-detection conflict between the HDR and RAW readers for .hdr files. #5256 #5339
• ico: Better error checking for PNG-in-ICO files, and avoid leaking an error string across a png_chunk_error longjmp. #5264 #5289
• iff: Detect corrupt chunk sizes, flags, and channel configs, fixing a tile read that could write past the caller's buffer. #5268 (CVE-2026-63419)
• iff: Add resolution validity checking, and reject implausible image dimensions before allocating the tile buffer. #5285 #5284
• imagebuf: Fix a data race that could corrupt multithreaded reads. #5325
• imageio: Ignore invalid RowsPerStrip chunking. #5300 (by @br0nzu / Dongju Lee)
• jpeg2000: Reject corrupt component geometry and subsampling, and guard against oversized and decompression-bomb headers before decode. #5270 #5327
• jxl: Guard corrupt basic-info dimensions early. #5305
• ptex: More comprehensive valid_file and header validation. #5265
• psd: Validate color_mode before the RawColor early return, fixing an out-of-bounds read and allocation DoS. #5282 (CVE-2026-63635)
• psd: Detect implausibly large ICC, Exif, and XMP blocks before allocating, and identify corruption of layer resolutions and EOF in strings. #5288 #5259
• psd: Guard row interleave bounds on corrupt data, fixing an out-of-bounds read in interleave_row. #5307 (CVE-2026-63420)
• psd: Avoid signed overflow computing layer/mask extents. #5306
• raw: Apply LibRaw memory cap before unpack to prevent OOM, and reject decompression-bomb / corrupt headers before unpack. #5275 #5312
• raw: Pass the bad-pixels parameter through to LibRaw. #5323 (by @antond-weta / Anton Dukhovnikov)
• rla: Better detection of corrupted RLE encoding. #5337 #5258
• sgi: Size RLE offset tables by spec dimensions to prevent OOB on corrupt headers, prevent an oversized-allocation crash from a bogus RLE length/offset table, and handle corrupt 16-bit RLE runs with odd byte counts. #5279 #5303 #5321
• softimage: Support channel packets with differing bit depths. #5309
• tiff: Avoid use-after-scope in multithreaded scanline reads. #5294 (CVE-2026-65970)
• tiff: Fix heap overflow unpacking sub-8-bit contiguous CMYK samples. #5296 (CVE-2026-67549)
• tiff: Fix additional int32 overflows, and guard against decompression bombs. #5319
• webp: Improve valid_file to check the header for magic words. #5266
• int: Consolidate the decompression-bomb guard used across format readers into a shared helper. #5328
• build: Fix EMBEDPLUGINS=0, and make many build options environment-overridable. #5272
• build: Support building to WebAssembly (wasm). #5304 (by @nickdademo / Nick D'Ademo)
• build: Support OpenCV 5, and add a standalone header smoke test. #5326
• build: Recommend libtiff >= 4.5 for security fixes. #5277
• build: Fix clang warnings about giflib headers on some platforms/versions. #5263
• ci: Add vfx2027 container tests; test against and document the latest dependency versions. #5302 #5330
• docs: Fix typos. #5349 (by @jinhgkim / Jinnie Kim)
• docs: Update ImageCache docs, clean up outdated docs, and fix typos. #5352 (by @luna-y-kim / Luna Kim)
• docs: Fix vcpkg install command syntax in INSTALL.md. #5332 (by @BrianHanke / Brian R Hanke)
• admin: SECURITY.md updates; very minor fixes to README & SECURITY; update SECURITY with new CVE assignments; document more security CVE number assignments. #5311 #5320 #5329
• Contributors: First-time contributors to this release: Brian R Hanke, Dongju Lee, Jinnie Kim, Nick D'Ademo.