CVE-2026-67549

Katalog CVE

CVSS 7.6 · High EPSS 0,29%

Kerentanan Heap-based Buffer Overflow pada openimageio. Skor CVSS 3.1 7.6 (High) menurut github.com.

Deskripsi (NVD)

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::read_native_scanline_locked() nevertheless invokes tiffinput::bit_convert() with 8-bit output and writes one expanded byte per value into that smaller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::bit_convert(), TIFFInput::read_native_scanline_locked(), PHOTOMETRIC_SEPARATED, 1-bit CMYK, and native uint1 ImageSpec, which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

7.6 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-131: Incorrect Calculation of Buffer Size
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3wxw-rqhw-j2w4 exploit · advisory vendor
• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/6e9b86ee4cce8fd7bed6cfb101a266d8f8a296d4 patch
• https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5296 issue tracking · patch
• https://github.com/user-attachments/files/29615314/poc.zip exploit
• https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0 release notes