CVE-2026-67549: OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::readnativescanlinelocked() nevertheless invokes tiffinput::bitconvert() with 8-bit output and writes one expanded byte per value into that smaller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::bitconvert(), TIFFInput::readnativescanlinelocked(), PHOTOMETRICSEPARATED, 1-bit CMYK, and native uint1 ImageSpec, which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenImageIOto a version that resolves this vulnerability.Fixed in 3.1.16.0 - Compensating control
If you must run a version prior to 3.1.16.0, avoid processing crafted 1-bit contiguous CMYK TIFFs (PHOTOMETRIC_SEPARATED with 1-bit CMYK using native uint1 ImageSpec) to prevent the heap out-of-bounds write triggered by TIFFInput::read_native_scanline_locked() -> TIFFInput::bit_convert().
Event History
Frequently Asked Questions
Which deployments are affected?
OpenImageIO versions prior to 3.1.16.0 are affected when they process a crafted 1-bit contiguous CMYK TIFF through the native uint1 ImageSpec path.
What is required to trigger the memory corruption?
An attacker needs a crafted TIFF using PHOTOMETRIC_SEPARATED 1-bit CMYK data. The vulnerable path is reached when TIFFInput reads a native scanline and expands bit values into a caller-provided bit-packed buffer.
How can I determine whether my build contains the vulnerable implementation?
Affected source contains TIFFInput::bit_convert() and TIFFInput::read_native_scanline_locked() in src/tiff.imageio/tiffinput.cpp with the described 1-bit CMYK native uint1 handling. Upgrading to 3.1.16.0 removes the issue.