{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "3.1.16.0"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "31201c22df477b105b105c0dcfbf5d3d46db431b"
            },
            {
              "fixed": "f3f12ab761fbccaa644937780e7246674033c407"
            }
          ],
          "repo": "https://github.com/academysoftwarefoundation/openimageio",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-v278-gpwr-r836"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-825"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65970.json"
  },
  "details": "OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through an error path while asynchronous strip-decompression work remains queued. Because task_set is declared before ok and compressed_scratch, those captured objects are destroyed before the task-set destructor waits, allowing worker tasks to use stale stack and heap storage, resulting in a use-after-scope crash and denial of service. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::read_native_scanlines(), task_set, ok, compressed_scratch, and uncompress_one_strip(), which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.",
  "id": "CVE-2026-65970",
  "modified": "2026-09-20T11:30:17.751422001Z",
  "published": "2026-09-18T15:41:36.413Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-v278-gpwr-r836"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65970.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65970"
    },
    {
      "type": "FIX",
      "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/31201c22df477b105b105c0dcfbf5d3d46db431b"
    },
    {
      "type": "FIX",
      "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5294"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenImageIO: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines`"
}