{"id":"CVE-2026-67549","revision":"88fa7b6d95ff491da1c14a8466f4050f","records":[{"revision":"88fa7b6d95ff491da1c14a8466f4050f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-67549","aliases":[],"title":"OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write","description":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::read_native_scanline_locked() nevertheless invokes tiffinput::bit_convert() with 8-bit output and writes one expanded byte per value into that smaller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::bit_convert(), TIFFInput::read_native_scanline_locked(), PHOTOMETRIC_SEPARATED, 1-bit CMYK, and native uint1 ImageSpec, which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.","state":0,"publishedAt":"2026-09-18T15:49:38.085+00:00","modifiedAt":"2026-09-24T20:57:37.31+00:00","affected":[{"ecosystem":"Vendor product","name":"OpenImageIO","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"AcademySoftwareFoundation\",\n                    \"product\": \"OpenImageIO\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.1.16.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","score":7.6,"severity":"HIGH"}],"references":["https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3wxw-rqhw-j2w4","https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5296","https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/6e9b86ee4cce8fd7bed6cfb101a266d8f8a296d4","https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-67549","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-67549","identifiers":["CVE-2026-67549"]},"retained":false,"historicalAffected":[]}],"coverage":[]}