CVE-2026-65970 in OpenImageIO
Summary
by MITRE • 09/18/2026
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through an error path while asynchronous strip-decompression work remains queued. Because task_set is declared before ok and compressed_scratch, those captured objects are destroyed before the task-set destructor waits, allowing worker tasks to use stale stack and heap storage, resulting in a use-after-scope crash and denial of service. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::read_native_scanlines(), task_set, ok, compressed_scratch, and uncompress_one_strip(), which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within OpenImageIO prior to version 3.1.16.0 represents a critical concurrency flaw rooted in improper resource management during asynchronous image processing operations. OpenImageIO serves as a foundational toolset for the visual effects and animation industries, handling complex image file formats such as TIFF which often utilize compression techniques like ZIP to manage large data volumes efficiently. The specific defect occurs within the TIFF input module when multithreading is enabled, allowing multiple worker threads to process different strips of an image simultaneously. This architecture relies on a task set mechanism to coordinate asynchronous strip-decompression work, ensuring that all background tasks complete before the main processing function returns control or proceeds with subsequent operations.
The technical root cause lies in the variable declaration order and scope management within the TIFFInput::read_native_scanlines() implementation found in src/tiff.imageio/tiffinput.cpp. Specifically, local objects such as task_set, ok, and compressed_scratch are declared on the stack before being utilized for asynchronous tasks. When a crafted ZIP-compressed TIFF file triggers an error condition during processing, the function exits via an early return path due to the detected fault. Because these critical state variables are destroyed immediately upon exiting their scope, any worker threads that were queued by task_set continue to execute in the background using memory addresses associated with those now-destroyed stack and heap objects. This creates a classic use-after-scope scenario where asynchronous tasks attempt to access stale storage locations that have already been reclaimed or overwritten by other system processes.
This race condition leads directly to undefined behavior, most commonly manifesting as application crashes resulting in denial of service for the user or automated pipeline processing systems relying on OpenImageIO. The integrity of the memory is compromised because worker threads operate under the assumption that their allocated resources remain valid throughout the duration of decompression tasks. When these assumptions fail due to premature destruction of parent scope variables, data corruption occurs, leading to segmentation faults or other fatal errors. This issue highlights a significant gap in synchronization logic where error handling paths do not properly wait for pending asynchronous work to complete before tearing down dependent state objects.
From a classification perspective, this vulnerability aligns with CWE-416, Use After Free, as it involves accessing memory after it has been made available for reuse through scope exit and object destruction. It also relates to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, given the failure to properly synchronize thread completion before resource deallocation. In terms of adversarial tactics, this could be leveraged in an attack scenario categorized under ATT&CK technique T1499, Endpoint Denial of Service, where a malicious actor provides specially crafted input to disrupt service availability for creative professionals or automated rendering pipelines.
The recommended mitigation is straightforward and definitive: upgrade OpenImageIO to version 3.1.16.0 or later, which contains the corrected implementation that ensures proper synchronization between asynchronous tasks and resource lifecycle management. For organizations unable to immediately patch their environments, implementing strict input validation on TIFF files before processing can reduce exposure, though this does not eliminate the underlying code flaw. Developers should also review similar patterns in other image processing libraries where multithreading is employed with local scope variables managing background task lifecycles, ensuring that all asynchronous operations are explicitly joined or awaited prior to exiting functions that declare dependent resources on the stack.