OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::read_native_scanline_locked() nevertheless invokes tiffinput::bit_convert() with 8-bit output and writes one expanded byte per value into that smaller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::bit_convert(), TIFFInput::read_native_scanline_locked(), PHOTOMETRIC_SEPARATED, 1-bit CMYK, and native uint1 ImageSpec, which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.
CVE-2026-67549
This high-severity CVE scores 7.6 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- High severity, but no confirmed exploitation yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 7.6
- EG Score
- 7.6(low)
- EG Risk
- 39(Track)EG Risk 39/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity76% × 45%Exploitation0% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- Not listed
Published
September 18, 2026
Last Modified
September 18, 2026
Advisory Details (4)
Auto-updated Sep 18, 2026v3.1.16.0
Patch available: AcademySoftwareFoundation/OpenImageIO v3.1.16.0
https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.16.0commit 6e9b86ee4cce (AcademySoftwareFoundation/OpenImageIO)
Fix landed in AcademySoftwareFoundation/OpenImageIO commit 6e9b86ee4cce — awaiting tagged release
https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/6e9b86ee4cce8fd7bed6cfb101a266d8f8a296d4fix(tiff): fix heap overflow unpacking sub-8-bit contig CMYK samples
Fix merged in AcademySoftwareFoundation/OpenImageIO PR #5296 on 2026-07-04 — awaiting tagged release
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5296TIFF 1-bit CMYK bit conversion heap out-of-bounds write · Advisory · AcademySoftwareFoundation/OpenImageIO · GitHub
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3wxw-rqhw-j2w4Weakness Classification(3)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 3× in last 7d / 3× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-09-18 16:26 UTCEG score recompute
- 2026-09-18 15:55 UTCEG score recompute
- 2026-09-18 15:54 UTCMITRE cvelistV5first tracked
Frequently asked(4)
What is CVE-2026-67549?
When was CVE-2026-67549 disclosed?
What is the CVSS score of CVE-2026-67549?
How do I remediate CVE-2026-67549?
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-67549
Is Your Infrastructure Affected by CVE-2026-67549?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.