CVE-2026-65970

Executive Summary

CVE-2026-65970 is a use-after-scope (CWE-825) denial-of-service vulnerability in OpenImageIO, a widely used toolset for reading, writing, and manipulating image files in VFX/animation pipelines. Prior to 3.1.16.0, processing a crafted ZIP-compressed TIFF with TIFF multithreading enabled causes TIFFInput::read_native_scanlines() to exit via an error path while asynchronous strip-decompression work remains queued, allowing worker tasks to access destroyed stack and heap storage. Successful triggering results in a crash and denial of service; there is no impact to confidentiality or integrity (CVSS 5.3, AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H).

Technical Analysis

OpenImageIO's TIFF input plugin performs strip decompression via asynchronous worker tasks. In the affected implementation (src/tiff.imageio/tiffinput.cpp), the function TIFFInput::read_native_scanlines() schedules strip-decompression work through a task set (task_set) and uses related state including ok and compressed_scratch. The vulnerability arises from object lifetime ordering: task_set is declared before ok and compressed_scratch. Under C++ destruction ordering rules, objects are destroyed in reverse order of declaration, so ok and compressed_scratch (the captured objects) are destroyed before the task_set destructor executes and waits for pending worker tasks. When a crafted ZIP-compressed TIFF forces read_native_scanlines() to return through an error path while asynchronous strip-decompression work (uncompress_one_strip()) is still queued, the waiting task-set destructor allows those worker tasks to run after their captured stack and heap storage has already been released. This is a use-after-scope condition: workers dereference stale memory, producing a crash and denial of service.

Attack surface: any OpenImageIO consumer that decodes TIFF files with TIFF multithreading enabled. The trigger is a malformed ZIP-compressed TIFF that induces the early error-return path in read_native_scanlines(). The flaw is a concurrency/lifetime-ordering defect, not an authentication or injection issue; it requires user interaction (opening/processing the crafted image) and is rated high attack complexity (AC:H) because timing and crafted-input conditions must align to leave tasks queued at the error return. Scope is unchanged (S:U) — impact is confined to the vulnerable process.

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain described below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: An adversary identifies a target that uses OpenImageIO (< 3.1.16.0) to ingest TIFF images, e.g., a VFX/rendering pipeline, an asset-processing service, or a media upload endpoint that decodes TIFFs with TIFF multithreading active.
2. Triggering the flaw: The adversary crafts a ZIP-compressed TIFF designed so that TIFFInput::read_native_scanlines() returns via its error path while asynchronous strip-decompression work (uncompress_one_strip()) remains queued. The crafted file is delivered to the target, e.g., uploaded to a media intake service or placed in a render/asset pipeline.
3. Payload/execution method (vulnerability-class level): When the target processes the TIFF, worker tasks are still pending as the function unwinds. Because task_set is declared before ok and compressed_scratch, those captured objects are destroyed first, and the task-set destructor subsequently waits on workers that proceed to use stale stack/heap storage — a use-after-scope.
4. Post-exploitation impact: The stale-memory access causes a crash (segfault), resulting in denial of service. Given S:U and C:N/I:N, there is no demonstrated path to code execution, data disclosure, or file integrity impact from this CVE alone; impact is limited to availability of the decoding process.

Impact Assessment

The vulnerability causes use-after-scope memory access leading to a crash and denial of service. CVSS 3.1 subscores: AV:N (network-reachable input), AC:H (crafted input plus precise lifetime/timing conditions required), PR:N (no privileges required), UI:R (victim must open/process the crafted image), S:U (impact confined to the vulnerable component), C:N/I:N (no confidentiality or integrity impact), A:H (high availability impact). Business impact centers on availability: crashed image-processing or rendering workers, failed ingest jobs, and potential service disruption in pipelines that automatically decode user-supplied TIFFs. Blast radius is limited to processes decoding the crafted file; there is no cross-system propagation, no privilege escalation, and no data compromise demonstrated. EPSS is not yet scored by FIRST.org, and there is no CISA KEV listing or exploit-in-the-wild evidence.

Detection Guidance

Sigma Rule

title: OpenImageIO TIFF Use-After-Scope Crash (CVE-2026-65970) - Repeated Decoder Failures
id: 3f9c1a2e-7d4b-4c1a-9e2f-6a1b0c9d5e70
status: experimental
description: Detects repeated crashes/faults of OpenImageIO-based TIFF decoding processes, consistent with a use-after-scope DoS via crafted ZIP-compressed TIFF.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65970
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/oiiotool'
      - '/iconvert'
      - '/idiff'
  selection_fault:
    message|contains:
      - 'read_native_scanlines'
      - 'tiffinput.cpp'
      - 'use-after-scope'
      - 'AddressSanitizer'
      - 'SEGV'
  condition: selection_proc and selection_fault
falsepositives:
  - Unrelated memory errors in image tooling
  - CI fuzzers intentionally feeding malformed TIFFs
level: medium
tags:
  - attack.t1499
  - cve.2026-65970

YARA Rule

rule CVE_2026_65970_OpenImageIO_TIFF_ZIP_Crash
{
    meta:
        description = "Detects crafted ZIP-compressed TIFF files associated with CVE-2026-65970 (targets presence of TIFF + ZIP markers)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65970"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $tiff_le = { 49 49 2A 00 }
        $tiff_be = { 4D 4D 00 2A }
        $zip_pk  = { 50 4B 03 04 }

    condition:
        filesize < 100MB and
        ($zip_pk at 0 or $zip_pk at 0x100 or $zip_pk at 0x200) and
        ($tiff_le or $tiff_be)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65970 OpenImageIO Crafted ZIP-compressed TIFF Upload Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"|50 4B 03 04|"; http.request_body; content:"|49 49 2A 00|"; http.request_body; http.content_type; content:"tif"; nocase; reference:cve,2026-65970; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65970; classtype:attempted-dos; sid:2026659700; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

process where event.type == "start" and
  process.name in ("oiiotool", "iconvert", "idiff") and
  process.args : "*.tif*"

Splunk SPL Query

index=os OR index=app (process=oiiotool OR process=iconvert OR process=idiff)
| search "*read_native_scanlines*" OR "*tiffinput.cpp*" OR "*use-after-scope*" OR "*SEGV*"
| stats count min(_time) as first_seen max(_time) as last_seen by host process
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="openimageio,cve-2026-65970,">
  <rule id="2026970" level="6">
    <decoded_as>syslog</decoded_as>
    <match>read_native_scanlines|tiffinput.cpp|use-after-scope|AddressSanitizer</match>
    <description>CVE-2026-65970: Possible OpenImageIO TIFF use-after-scope crash detected</description>
    <group>denial_of_service,cve_2026_65970,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Disable TIFF multithreading when decoding untrusted TIFFs if the configuration allows it; isolate TIFF decoding in a sandboxed/short-lived worker with process supervision and automatic restart; restrict or validate uploaded TIFFs (including ZIP-compressed TIFFs) before ingestion; reject untrusted multi-layer/ZIP-compressed TIFF input where business requirements permit.
2. Patch/upgrade steps: Upgrade OpenImageIO to 3.1.16.0 or later, where the issue is fixed. Verify the deployed version of oiiotool/iconvert/library and rebuild dependent pipeline components against the patched release. Because no tracked patch source was available at reporting time, confirm the fix directly in the 3.1.16.0 changelog/release notes before deployment.
3. Long-term hardening: Add fuzzing/CI for image decoders, run decoders under AddressSanitizer in test pipelines, enforce least privilege and resource limits on image-processing services, and monitor for repeated decoder crashes as an availability signal.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-65970
• https://github.com/AcademySoftwareFoundation/OpenImageIO (project release notes for 3.1.16.0)
• https://cwe.mitre.org/data/definitions/825.html (CWE-825: Expired Pointer Dereference)
• https://attack.mitre.org/techniques/T1499/ (MITRE ATT&CK T1499 — Endpoint Denial of Service)

No known threat actor campaigns or exploit-in-the-wild evidence were identified; no public PoC, no Nuclei template, and no CISA KEV listing exist as of this report.