TI-2026-47733 Aliases CVE-2026-67549

OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write

HIGH 66CWE-122Published 2026-09-18 · Updated 2026-09-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::read_native_scanline_locked() nevertheless invokes tiffinput::bit_convert() with 8-bit output and writes one expanded byte per value into that smaller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::bit_convert(), TIFFInput::read_native_scanline_locked(), PHOTOMETRIC_SEPARATED, 1-bit CMYK, and native uint1 ImageSpec, which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00288 21st percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed OpenImageIO (AcademySoftwareFoundation): 3.1.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
AcademySoftwareFoundation	OpenImageIO	before 3.1.16.0	3.1.16.0	Patch available	CNA

OpenImageIO VendorAcademySoftwareFoundation Affected before 3.1.16.0 Fixed in 3.1.16.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openimageio:openimageio::::::::	before 3.1.16.0	Vulnerable	OpenImageIO Project

cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:* Versions before 3.1.16.0 Vulnerable ·OpenImageIO Project

Remediation

Fix · CNA OpenImageIO (AcademySoftwareFoundation) Fixed in 3.1.16.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-67549

References

Exploit 2

Patch 2

Other 1

https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0

TI-2026-30739 OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser CVSS 4.0HIGH 8.4
TI-2026-38605 OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) CVSS 4.0HIGH 7.1
TI-2026-48281 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union CVSS 3.1HIGH 7.1
TI-2026-48279 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision CVSS 3.1HIGH 7.1
TI-2026-42768 OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow CVSS 3.1HIGH 7.1
TI-2026-42338 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin CVSS 3.1HIGH 7.1

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences