{"id":"CVE-2026-65970","summary":"OpenImageIO: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines`","details":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through an error path while asynchronous strip-decompression work remains queued. Because task_set is declared before ok and compressed_scratch, those captured objects are destroyed before the task-set destructor waits, allowing worker tasks to use stale stack and heap storage, resulting in a use-after-scope crash and denial of service. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::read_native_scanlines(), task_set, ok, compressed_scratch, and uncompress_one_strip(), which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.","aliases":["GHSA-v278-gpwr-r836"],"modified":"2026-09-20T14:13:53.039199Z","published":"2026-09-18T15:41:36.413Z","related":["openSUSE-SU-2026:11442-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-825"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65970.json"},"references":[{"type":"WEB","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0"},{"type":"ADVISORY","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-v278-gpwr-r836"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65970.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65970"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/31201c22df477b105b105c0dcfbf5d3d46db431b"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5294"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/academysoftwarefoundation/openimageio","events":[{"introduced":"0"},{"fixed":"31201c22df477b105b105c0dcfbf5d3d46db431b"},{"fixed":"f3f12ab761fbccaa644937780e7246674033c407"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.1.16.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v3.1.15.0","v3.1.14.1","v3.1.14.0","v3.1.13.1","v3.2.0.2-dev","v3.1.13.0","v3.1.12.0","v3.1.11.0","v3.2.0.0-dev","v3.1.10.0","v3.1.9.0","v3.1.8.0","v3.1.7.0","v3.1.6.2","v3.1.6.1","v3.1.6.0-rc1","v3.1.5.0-beta2","v3.1.4.0-beta","v3.0.0.0-beta1","v2.6.5.0-dev","v2.6.2.0-dev","v2.6.1.0-dev","v2.5.2.0-dev","v2.5.0.0-dev","v2.4.2.2-dev","v2.4.2.1-dev","v2.4.2.0-dev","v2.4.1.1-dev","v2.4.0.3-dev","v2.4.0.2-dev","v2.4.0.1-dev","v2.4.0.0-dev","v2.3.6.0-dev","v2.3.5.0-dev","Release-2.3.4.0-dev","Release-2.3.3.0-dev","Release-2.3.2.0-dev","Release-2.3.1.0-dev","Release-2.3.0.0-dev","Release-2.2.3.0-dev","Release-2.2.2.0-dev","Release-2.2.1.1-dev","Release-2.2.1.0-dev","Release-2.2.0.0-dev","Release-2.1.8.0-RC1","Release-2.1.7-beta","Release-2.1.5.0-dev","Release-2.1.4.0-dev","Release-2.1.3-dev","spi-spcomp2-release-49.1","spi-Arn3.7.42.0","Release-2.1.2-dev","Release-2.1.1-dev","Release-2.1.0-dev","spi-spcomp2-release-48.0","spi-Arn3.7.25.0","spi-spcomp2-release-47.0","spi-Arn3.7.23.3","Release-2.0.1-RC1","Release-2.0.0-beta1","spi-spcomp2-release-45.4","spi-spcomp2-release-45.3","spi-spcomp2-release-45.1","spi-spcomp2-release-45.0","Release-1.9.4dev","Release-1.9.3dev","Release-1.9.2dev","spiArn-3.6.86.0","spi-spcomp2-release-44.2","spiArn-3.6.94.0","spi-spcomp2-release-44.1","spi-spcomp2-release-44.0","spiArn-3.6.84.0","spiArn-3.6.74.0","spi-Arn3.6.72.1","Release-1.9.1dev","spi-Arn3.6.69.3","spi-spcomp2-release-43.0","spi-Arn3.6.64.6","Release-1.8.4dev","spi-spcomp2-release-42.0-rhel7","spi-Arn3.6.36.0","Release-1.8.3dev","Release-1.8.2dev","spi-Arn3.6.33.4","spi-Arn3.6.27.0","Release-1.8.1dev","spi-Arn3.6.21.3","spi-Arn3.6.18.0","Release-1.8.0dev","spi-spcomp2-release-41.0","Release-1.7.6RC1","spi-Arn3.6.7.1","Release-1.7.5beta","Release-1.7.4dev","Release-1.7.3dev","spi-Arn3.5.93.10","spi-Arn3.5.91.0","Release-1.7.2dev","spi-Arn3.5.90.0","spiArn3.5.82.0","Release-1.7.1dev","Release-1.7.0dev","spiArn3.5.75.0","spi-spcomp2-release-39.1","Release-1.6.6beta","spiArn3.5.68.0","spi-spcomp2-release-38.0","spiArn3.5.66.0","spi-Arn3.5.82.0","spi-Arn3.5.75.0","spi-Arn3.5.68.0","spi-Arn3.5.66.0","spi-Arn3.4.72.0","spi-Arn3.4.71.0","Release-1.6.4dev","spiArn3.5.50.0","spi-Arn3.5.50.0","Release-1.6.3dev","spiArn3.5.48.0","spi-Arn3.5.48.0","spiArn3.5.45.1","spiArn3.5.45.0","spi-Arn3.5.45.1","spi-Arn3.5.45.0","spi-Arn3.5.41.0","Release-1.6.2dev","spi-Arn3.5.37.0","spi-Arn3.5.35.0","Release-1.6.1dev","spi-Arn3.5.31.0","spi-Arn3.5.28.0","spi-Arn3.5.26.0","spi-Arn3.5.25.0","Release-1.5.7dev","spi-Arn3.5.24.0","Release-1.5.6dev","Release-1.5.5dev","spi-Arn3.5.16.0","spi-Arn3.5.14.0","Release-1.5.4dev-pre-SIMD","spi-Arn3.5.13.1","Release-1.5.3dev","spi-Arn3.5.12.0","Release-1.5.2dev","spi-Arn3.5.11.0","spi-Arn3.5.10.0","Release-1.5.1dev","spi-Arn3.5.8.0","Release-1.5.0dev","spi-Arn3.5.5.0","Release-1.4.6RC1","spi-Arn3.5.2.0","Release-1.4.5dev","spi-Arn3.5.0.0","spi-Arn3.4.73.7","Release-1.4.4dev","Release-1.4.3dev","spi-v8-Arn3.4.73.6","spi-Arn3.4.73.6","Release-1.4.2dev","spi-v7-Arn3.4.73.3","Release-1.4.1dev","Release-1.3.6-dev","Arnold-3.4.72.0","arnold-3.4.71.0","Release-1.3.5-dev","Release-1.3.5","Release-1.3.4-dev","Release-1.3.3-dev","Release-1.3.2-dev","Release-1.3.1-dev","Release-1.3.0-dev","Release-1.1.1","Release-1.1.0","Release-1.1.0-beta4","Release-1.1.0-beta3","Release-1.1.0-beta2","Release-1.1.0-beta1","Release-1.0.1","Release-1.0.0","Release-0.10.0","spi-SpComp2-v20","spi-SpComp2-v9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65970.json","vanir_signatures_modified":"2026-09-20T14:13:53Z","vanir_signatures":[{"source":"https://github.com/academysoftwarefoundation/openimageio/commit/31201c22df477b105b105c0dcfbf5d3d46db431b","target":{"file":"src/tiff.imageio/tiffinput.cpp"},"deprecated":false,"digest":{"line_hashes":["36694321810502191571665737517037472880","198354780405579116980809838236221681071","207460894733933637402762027704169548160","299470351523266658997109603500476333484","225322062417160997948260363103819948786","218282084677241588094825117038603910806","225448448269990351552125111851202999109","244940274772189295801782728390631050645","171023984721838084785058432058904831936","242719782429211801373218749539897766120","29383929931921563807853142963718071930","122574688808026817775684466755606759740","119098754273303259463205972503669092866","63359812155755748764770577302442423755","205539825102272040646269141014005305867","321823042008267134184524505918196577139","318950129588500126574821769086440428750","193958679590368071257248191200517707564"],"threshold":0.9},"id":"CVE-2026-65970-a12f5206","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}