Vulnerability Details CVE-2026-67549
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::read_native_scanline_locked() nevertheless invokes tiffinput::bit_convert() with 8-bit output and writes one expanded byte per value into that smaller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::bit_convert(), TIFFInput::read_native_scanline_locked(), PHOTOMETRIC_SEPARATED, 1-bit CMYK, and native uint1 ImageSpec, which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 28.7%
CVSS Severity
CVSS v3 Score 7.6
References
- https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/6e9b86ee4cce8fd7bed6cfb101a266d8f8a296d4
- https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5296
- https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0
- https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3wxw-rqhw-j2w4
- https://github.com/user-attachments/files/29615314/poc.zip