OpenImageIO CVE-2026-65970

Requires two specific conditions: (1) the target must process an attacker-crafted ZIP/Deflate-compressed TIFF, and (2) TIFF multithreading must be enabled so strip decompression runs asynchronously via task_set/uncompress_one_strip(). Exploitation is further limited by UI:R (a user or pipeline must open the malicious file), by AC:H (the crash depends on the decode taking the error path while worker tasks are still queued - a timing/race window), and by the affected version being prior to 3.1.16.0. Impact is confined to a crash (denial of service); there is no memory disclosure or code execution.

All signals converge on a low-to-moderate, availability-only issue. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.3) describes a pure denial-of-service: no confidentiality or integrity impact, a high attack complexity, and required user interaction (a victim must process an attacker-supplied file). CWE-825 (use-after-scope / expired-pointer dereference) matches the root cause: in TIFFInput::read_native_scanlines() the task_set was declared before the ok flag and compressed_scratch buffer, so an early error-path return destroyed those captured objects before the task-set destructor waited on still-queued strip-decompression worker tasks - the workers then touch freed stack/heap storage and crash. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation; the outcome is a crash, not code execution. AC:H is well justified because the bug is a race that only manifests when the multithreaded decode path takes the error branch while async work is still outstanding, making reliable triggering nontrivial. One notable inconsistency: the vector uses AV:N, but the described trigger is a locally processed crafted TIFF, which is closer to AV:L unless OpenImageIO is embedded in a network-facing image-processing service - defenders should judge the vector by their own deployment. Net: a real correctness bug worth patching, but a low operational priority (best-case DoS, high complexity, needs user interaction, non-default multithreading path).

An attacker crafts a malicious ZIP-compressed (Deflate) TIFF and gets a victim or an automated pipeline to open it with OpenImageIO while TIFF multithreading is enabled. The early error-path return destroys the ok flag and compressed_scratch buffer while worker threads are still decompressing strips, so those threads dereference freed storage and crash the host application. No public exploit code was provided, and the impact is limited to a denial of service.