OpenImageIO TIFF Multithreaded Read: Use-After-Scope Vulnerability & Fix

Vulnerability Key Information Summary Vulnerability Overview Title: Use-after-scope vulnerability in multi-threaded TIFF scanline reading in OpenImageIO, located in . Severity: CVSS v2 score 5.3/10 (Moderate). Root Cause: In and the current branch, is declared before local variables such as and . Since C++ local variables are destroyed in reverse order of declaration, and are destroyed before . Because is only called within the destructor to wait for queued tasks, the lambdas in the queue may access the already destroyed and , resulting in dangling pointers. Scope of Impact Affected Versions: OpenImageIO and the current branch (commit ). Fixed Version: . Trigger Condition: A ZIP-compressed TIFF file crafted by an attacker, triggered when read via or in the multi-threaded scanline reading path. Observable Impact: - In non-ASAN builds, crashes with (exit code 139). - In ASAN builds, a report is generated. POC / Exploit Code This file is a , 4-channel, ZIP-compressed ( ) TIFF. Multi-threaded scanline processing must be enabled, and triggering occurs with metadata-only opening. Remediation 1. Declare before capturing local variables ( , , , and other data captured by lambdas) to ensure is destroyed last. 2. Prefer using scope blocks; end the scope before submitting tasks and call in the real path to wait for all tasks to complete. 3. Avoid capturing tasks by non-atomic reference to ; instead, pass state by value or by stack copy. 4. Add regression tests to run this POC with and , expecting clean harness and sanitizer diagnostic results.

Goal Reached Thanks to every supporter — we hit 100%!

OpenImageIO TIFF Multithreaded Read: Use-After-Scope Vulnerability & Fix

More from this source