A heap-based buffer overflow vulnerability in AcademySoftwareFoundation OpenImageIO versions prior to 3.1.16.0 poses a high risk of memory corruption and potential system instability.

The vulnerability is a heap-based buffer overflow (CWE-122) triggered when the library processes a malformed 1-bit CMYK TIFF file. Specifically, the TIFFInput::bit_convert function incorrectly writes 8-bit expanded data into a smaller, bit-packed buffer allocated during the read_native_scanline_locked process, which can be triggered by an unauthenticated user providing a malicious image file.

Successful exploitation of this vulnerability can result in memory corruption, which typically leads to an application crash, causing service disruption for VFX and animation workflows. Given the CVSS score of 7.6, the vulnerability is classified as High severity, as it could potentially be leveraged by an attacker to achieve arbitrary code execution on systems processing untrusted image data.

Immediate Action: Update the OpenImageIO library to version 3.1.16.0 or later immediately to resolve the buffer overflow condition.

Proactive Monitoring: Monitor systems that ingest external image files for unexpected process crashes or abnormal memory usage patterns in the OpenImageIO library.

Compensating Controls: Implement rigorous input validation or sandboxing for any services that process user-supplied TIFF files to restrict the impact of potential memory corruption events.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk for environments relying on OpenImageIO for media processing. Given the potential for memory corruption and the availability of a patched version, administrators should prioritize updating their software dependencies to version 3.1.16.0 without delay to ensure the integrity and stability of their production systems.