Memory Corruption Issue in OpenImageIO Toolset

CVE-2026-67549

What is CVE-2026-67549?

A memory corruption issue exists in the OpenImageIO toolset prior to version 3.1.16.0 due to improper handling of a crafted 1-bit contiguous CMYK TIFF file. The vulnerability arises from the function 'tiffinput::read_native_scanline_locked()', which calls 'tiffinput::bit_convert()' to convert bit-packed buffers into an 8-bit output format. This process leads to a heap out-of-bounds write when writing one expanded byte per value into a smaller buffer, resulting in potential instability or exploitation of the affected systems. Users are strongly advised to upgrade to version 3.1.16.0 or later to mitigate this risk.

References