AcademySoftwareFoundation OpenImageIO up to 3.1.15.9 TIFF Input Multithreading tiffinput.cpp read_native_scanlines use after free

Summaryinfo

A vulnerability marked as problematic has been reported in AcademySoftwareFoundation OpenImageIO. Affected is the function TIFFInput::read_native_scanlines of the file src/tiff.imageio/tiffinput.cpp of the component TIFF Input Multithreading. This manipulation causes use after free. This vulnerability appears as CVE-2026-65970. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in AcademySoftwareFoundation OpenImageIO. Affected by this vulnerability is the function TIFFInput::read_native_scanlines of the file src/tiff.imageio/tiffinput.cpp of the component TIFF Input Multithreading. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect availability. The summary by CVE is:

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through an error path while asynchronous strip-decompression work remains queued. Because task_set is declared before ok and compressed_scratch, those captured objects are destroyed before the task-set destructor waits, allowing worker tasks to use stale stack and heap storage, resulting in a use-after-scope crash and denial of service. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::read_native_scanlines(), task_set, ok, compressed_scratch, and uncompress_one_strip(), which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-65970 since 07/23/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 3.1.16.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenImageIO

Version

• 2.5.13.1
• 3.0.16.0
• 3.0.18.0
• 3.0.20.0
• 3.0.21.0
• 3.1.11.0
• 3.1.13.0
• 3.1.15.0
• 3.1.15.9

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/OpenImageIO/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion