CVE-2026-59184
Received Received - Intake

Heap Buffer Overflow in OpenEXR Image Processing

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application writes rows through FlatHalfChannel::row(). Affected consumers are tools, converters, render pipeline components, or image-processing services that accept untrusted EXR files and use FlatHalfChannel::row() on loaded images. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-59184
EUVD
EUVD-2026-65583

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation openexr to 3.4.13 (inc)
academysoftwarefoundation openexr 2.*
academysoftwarefoundation openexr 3.0.*
academysoftwarefoundation openexr 3.1.*
academysoftwarefoundation openexr 3.2.0
academysoftwarefoundation openexr 3.3.0
academysoftwarefoundation openexr 3.4.0
openexr openexr to 3.2.11 (exc)
openexr openexr From 3.3.0 (inc) to 3.3.12 (inc)
openexr openexr From 3.4.0 (inc) to 3.4.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenEXR involves a crafted EXR file with a non-zero dataWindow.min value causing TypedFlatImageChannel::row() to return an invalid heap pointer. This leads to out-of-bounds or use-after-free writes when applications use FlatHalfChannel::row() on loaded images. The issue affects versions before 3.2.11, 3.3.13, and 3.4.14.

Detection Guidance

Detecting this vulnerability requires checking the installed OpenEXR version. Use commands like 'openexr-config --version' or inspect package managers (e.g., 'dpkg -l | grep openexr' on Debian/Ubuntu). Compare the output against affected versions: 2.*, 3.0.*, 3.1.*, 3.2.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13.

Impact Analysis

This vulnerability can cause crashes (SIGSEGV) or heap corruption (use-after-free, out-of-bounds writes) when processing untrusted EXR files. It impacts tools, converters, render pipelines, or image-processing services that accept such files and use FlatHalfChannel::row() for pixel writes.

Compliance Impact

The vulnerability in OpenEXR could lead to out-of-bounds writes or use-after-free conditions when processing crafted EXR files. This may result in memory corruption, crashes, or arbitrary code execution, which could compromise data integrity and confidentiality. For organizations handling sensitive data under GDPR or HIPAA, such vulnerabilities may violate requirements for secure data processing and protection, potentially leading to compliance breaches if exploited.

Mitigation Strategies

Upgrade OpenEXR to patched versions: 3.2.11, 3.3.13, or 3.4.14. If using a package manager, run 'apt upgrade openexr' or equivalent. For source builds, pull the latest from the OpenEXR repository and recompile.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart