CVE-2026-65970: OpenImageIO: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines`
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::readnativescanlines() return through an error path while asynchronous strip-decompression work remains queued. Because taskset is declared before ok and compressedscratch, those captured objects are destroyed before the task-set destructor waits, allowing worker tasks to use stale stack and heap storage, resulting in a use-after-scope crash and denial of service. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::readnativescanlines(), taskset, ok, compressedscratch, and uncompressonestrip(), which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.1.16.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenImageIO versions before 3.1.16.0 are affected when they process a crafted ZIP-compressed TIFF with TIFF multithreading enabled. The impact described is a crash and denial of service.
What does an attacker need to trigger the vulnerability?
An attacker needs a victim to process a crafted ZIP-compressed TIFF through the affected scanline-reading path with TIFF multithreading enabled. No attacker privileges are required, but user interaction is required according to the supplied vector.
Is TIFF multithreading required for exploitation?
Yes. The described condition requires TIFF multithreading to be enabled, because asynchronous strip-decompression work must remain queued when the error path returns.
What version fixes the issue?
OpenImageIO 3.1.16.0 fixes the issue.