OpenImageIO EUVD-2026-83134

Exploitation requires the target application to read a crafted TIFF with the specific combination of PHOTOMETRIC_SEPARATED (CMYK, PhotometricInterpretation 5), 1 bit per sample (BitsPerSample 1), and contiguous/interleaved planar configuration (planarconfig contig), which causes OpenImageIO to expose a native uint1 ImageSpec and allocate a bit-packed buffer before bit_convert() overflows it. Exploitation is LIMITED by the need for user or application interaction (UI:R) - a victim must open or process the malicious image through software linked against OpenImageIO prior to 3.1.16.0; it is not a self-propagating or no-interaction remote flaw. It affects default parsing behavior for this TIFF variant (no special OIIO configuration is required), but only that narrow CMYK/1-bit/contiguous code path is vulnerable.

This is a heap out-of-bounds write (CWE-122) in OpenImageIO's TIFF reader, triggered when a crafted 1-bit contiguous CMYK TIFF is parsed: the ImageSpec is exposed as native uint1 (bit-packed buffer) but TIFFInput::bit_convert() writes one expanded 8-bit byte per value into that smaller allocation. The vendor CVSS 7.6 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) reflects network delivery of a malicious file but requires user/application interaction (UI:R) to open or process the image. No EPSS score, no CISA KEV listing, and no public exploit are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis' - this is not a confirmed in-the-wild threat. The signal set is internally consistent: AV:N reflects that images arrive over the network, but real exploitation depends on a host application feeding the file to OIIO. The A:H is well supported (heap corruption reliably crashes the parser); the C:L/I:L are conservative given that a controlled heap OOB write can, in principle, escalate toward code execution, though the vendor did not rate it as full RCE. Priority is moderate: the flaw is source-confirmed by the vendor advisory, PR, and fixing commit, but the lack of active-exploitation and POC signals plus the UI:R requirement keeps real-world urgency below that of an unauthenticated no-interaction RCE. Patch to 3.1.16.0 is the clear action.

An attacker crafts a malformed 1-bit contiguous CMYK TIFF and delivers it to a victim who opens or processes it through an application built on OpenImageIO (a VFX/render pipeline, asset ingest service, or thumbnailer). When TIFFInput reads the scanline, bit_convert() writes expanded 8-bit output into an undersized bit-packed uint1 buffer, corrupting the heap and crashing or potentially enabling further exploitation. No public POC is identified, but a crash-reproducer TIFF (crash-cmyk-1bit.tif) was added to the project's test suite in the fix.