CVE-2026-67549

Executive Summary

CVE-2026-67549 is a heap-based out-of-bounds write (CWE-122) in OpenImageIO, a widely used image I/O toolset for VFX and animation pipelines, affecting versions prior to 3.1.16.0. A crafted 1-bit contiguous CMYK TIFF is parsed into a native uint1 ImageSpec, causing TIFFInput::bit_convert() to emit 8-bit output into a bit-packed buffer and overwrite adjacent heap memory, yielding memory corruption with potential code execution. Exploitation requires user interaction (opening or processing a malicious image), and the vulnerability is currently unpatched per available tracking evidence.

Technical Analysis

The vulnerability resides in the TIFF reader of OpenImageIO, identified by src/tiff.imageio/tiffinput.cpp. The relevant logic is contained in TIFFInput::read_native_scanline_locked() and TIFFInput::bit_convert().

The flaw is a type/size mismatch between the declared image specification and the actual write performed during scanline conversion:

1. A crafted 1-bit contiguous CMYK TIFF carries the TIFF PHOTOMETRIC_SEPARATED photometric interpretation combined with 1-bit sample depth. When OpenImageIO exposes this image, callers receive a native uint1 ImageSpec — meaning the pixel data model assumes 1 bit per value.
2. Because the ImageSpec is uint1, downstream callers allocate a bit-packed output buffer sized for one bit per value.
3. However, TIFFInput::read_native_scanline_locked() nevertheless invokes TIFFInput::bit_convert() with an 8-bit output destination. bit_convert() then writes one expanded byte per pixel value into the buffer.
4. The destination buffer was sized for bit-packed data, but the write performs byte-per-value expansion — an 8x overrun. This produces a heap out-of-bounds write.

Because the mismatch is structural (declared sample model vs. conversion output width), the overflow is deterministic for the triggering image: every scanline expanded from 1-bit CMYK to 8-bit output writes beyond the allocated bit-packed region. Corruption of adjacent heap metadata and objects is the expected outcome.

Attack surface. The vulnerable code path is reached by any application that opens a TIFF through OpenImageIO — VFX asset pipelines, texture converters, thumbnailers, render-queue ingestion, viewer tools, and batch image processing services. The attacker controls the malformed TIFF; the victim's software processes it.

Weaknesses. CWE-122 (Heap-based Buffer Overflow). The fundamental defect is a failure to reconcile the buffer size implied by the 1-bit native ImageSpec with the 8-bit output width used by bit_convert(). No public PoC or exploit code has been observed, and no Nuclei template exists; the mechanism above is derived directly from the NVD description.

Exploitation Scenarios

No public PoC is available for CVE-2026-67549; the following chain is inferred from the vulnerability class (heap OOB write via image parser) and the mechanism described in the NVD record.

1. Reconnaissance / target identification. The attacker identifies a target that ingests TIFFs through OpenImageIO — a VFX studio asset pipeline, a render farm submit node, a media-processing service, or a developer/artist workstation running an affected build (< 3.1.16.0). Exposure is confirmed by version fingerprinting where the host is reachable, or simply by delivering the file to a user who processes untrusted imagery.
2. Triggering the flaw. The attacker crafts a TIFF that is 1-bit, contiguous, CMYK, and tagged with PHOTOMETRIC_SEPARATED. When parsed, OpenImageIO exposes a native uint1 ImageSpec, causing the caller to allocate a bit-packed buffer. Processing of the scanline reaches TIFFInput::read_native_scanline_locked(), which calls TIFFInput::bit_convert() with an 8-bit output width.
3. Payload / execution method (vulnerability-class level). bit_convert() writes one expanded 8-bit byte per pixel value into the undersized bit-packed buffer, producing a heap out-of-bounds write. The corrupted heap can be groomed so that the overflow overwrites adjacent allocations, in the classic heap-corruption pattern used to hijack control flow or corrupt in-memory structures. No POSIX/Windows-specific payload construction is described in the source data; the technique is the standard consequence of a controlled heap write in an image decoder.
4. Post-exploitation impact. Successful corruption can yield code execution in the context of the processing application, or at minimum a crash/denial of service resulting from heap metadata corruption. Because image pipelines often run with access to shared asset stores and render infrastructure, a compromise can pivot into broader studio/enterprise networks.

The UI:R CVSS subscore reflects that exploitation requires a user (or automated ingest process) to open the malicious image.

Impact Assessment

CVSS v3.1 base score is 7.6 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H. Subscores:

• AV:N — the malicious TIFF can be delivered over a network (email, download, shared storage, asset-exchange), so reachability is not limited to local files.
• AC:L — the trigger is deterministic; no race condition or special conditions beyond parsing the crafted file.
• PR:N — no privileges required to supply the file.
• UI:R — a user or automated pipeline must open/process the image.
• S:U — impact is confined to the vulnerable component's security authority.
• C:L / I:L — potential for limited disclosure and modification of data via heap corruption.
• A:H — high availability impact; heap corruption reliably causes crashes and process termination, and may destabilize services.

Business impact. OpenImageIO is embedded throughout VFX, animation, and media-processing toolchains, so a single crafted asset can be distributed via a content pipeline and detonated on many downstream workstations and render nodes. Consequences include studio pipeline disruption, loss of in-progress work, lateral movement from a workstation into shared infrastructure, and supply-chain-style propagation when malformed assets are accepted from third parties. No EPSS score is currently assigned by FIRST.org, so exploit-likelihood is not quantitatively established.

Detection Guidance

Sigma Rule

title: OpenImageIO 1-bit CMYK TIFF Heap Corruption Attempt
id: 7f4b9d2e-6754-49aa-9c1e-2026067549a1
status: experimental
description: Detects processes handling 1-bit contiguous CMYK TIFF files consistent with CVE-2026-67549 heap OOB write in OpenImageIO (< 3.1.16.0)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67549
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\oiiotool.exe'
      - '\iv.exe'
  selection_cmd:
    CommandLine|contains:
      - '.tif'
      - '.tiff'
  condition: selection_proc and selection_cmd
falsepositives:
  - Legitimate TIFF processing by artists and render pipelines
level: low

YARA Rule

rule CVE_2026_67549_OpenImageIO_CMYK_TIFF
{
    meta:
        author = "valtersit.com"
        description = "Detects 1-bit CMYK PHOTOMETRIC_SEPARATED TIFFs targeting OpenImageIO CVE-2026-67549"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-67549"
        date = "2026-01-01"
    strings:
        $tiff_le = { 49 49 2A 00 }
        $tiff_be = { 4D 4D 00 2A }
        $cmyk_sep = { 05 01 01 00 01 00 00 00 } // PhotometricInterpretation=SEPARATED, 1-bit
    condition:
        ($tiff_le at 0 or $tiff_be at 0) and $cmyk_sep
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-67549 OpenImageIO 1-bit CMYK TIFF Heap Corruption Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"|49 49 2A 00|"; content:"|05 01 01 00 01 00 00 00|"; classtype:attempted-user; sid:202667549; rev:1; reference:cve,2026-67549;)

Elastic Detection

process where process.name in ("oiiotool", "idiff", "iconvert") and
  process.args : "*.tif*" and
  process.command_line : "*cmyk*"

Splunk SPL Query

index=endpoint (Image="*oiiotool.exe" OR Image="*oiiotool" OR Process="*OpenImageIO*")
| search (CommandLine="*.tif" OR CommandLine="*.tiff")
| stats count min(_time) as first_seen max(_time) as last_seen by host, User, Image, CommandLine
| sort - last_seen

Wazuh OSSEC Rule

<group name="openimageio,">
  <rule id="100549" level="6">
    <if_sid>5925</if_sid>
    <field name="audit.command">oiiotool</field>
    <match>\.tif</match>
    <description>CVE-2026-67549: OpenImageIO processing a potential 1-bit CMYK TIFF heap-corruption trigger</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Treat TIFF assets as untrusted input. Quarantine and inspect externally sourced images before they enter the pipeline. Restrict the set of file types accepted by ingest services. Where feasible, run image-processing tasks with the lowest privileges necessary and in sandboxed or containerized workers to contain heap-corruption consequences. Block or gate TIFF ingestion from untrusted origins at e-mail gateways and file-exchange points. Monitor for crashes in OpenImageIO-based tooling, which may indicate exploitation attempts.
2. Patch / upgrade steps. The vulnerability is fixed in OpenImageIO 3.1.16.0. Upgrade all embedded and standalone OpenImageIO deployments to 3.1.16.0 or later, including VFX applications, plugins, render-management tools, and any services that bundle the library. Because no CVE-specific advisory URL is available from tracked sources, verify the fixed version against the upstream OpenImageIO release notes before deploying; maintain a single trusted vendor source of truth as vendor advisories are published.
3. Long-term hardening. Maintain a formal component-inventory (SBOM) so embedded OpenImageIO versions are discoverable across the toolchain. Establish a vulnerability-response process that can rapidly identify every product embedding an affected build. Add fuzzing (AFL++, libFuzzer) to image-parser CI stages, particularly for low-bit-depth and atypical photometric/color-space combinations such as 1-bit CMYK. Adopt exploitable-input hardening (ASLR, CFG, hardened allocators, strict IO/validation) across media pipelines. Prefer process isolation for decoders handling untrusted content.

References

• NVD — CVE-2026-67549: https://nvd.nist.gov/vuln/detail/CVE-2026-67549
• OpenImageIO project (fixed in 3.1.16.0): https://github.com/AcademySoftwareFoundation/OpenImageIO (verify release notes for 3.1.16.0)
• CWE-122 — Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-67549 is not currently listed (CISA KEV: NO)

Threat actor / exploitation evidence: No public PoC, no exploit code, no Nuclei template, and no known in-the-wild exploitation or threat-actor campaign is associated with CVE-2026-67549 in the data available. EPSS has not been scored by FIRST.org. Because the flaw is a deterministic heap overflow in a widely embedded parser and no patch has yet been confirmed in tracked sources, monitoring for exploitation attempts is warranted regardless.