CVE-2026-65970

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.1.16.0

Description A use-after-scope crash and denial of service can occur when processing a crafted ZIP-compressed TIFF file with TIFF multithreading enabled. The issue arises in the TIFFInput::read native scanlines() function within src/tiff.imageio/tiffinput.cpp. When an error path is triggered, the function may return while asynchronous strip-decompression work remains queued in the task set. Because task set is declared before the ok and compressed scratch variables, these captured objects are destroyed before the task set destructor can wait for the tasks to complete. This allows worker tasks, specifically within uncompress one strip(), to access stale stack and heap storage.

Recommendations Update to version 3.1.16.0.