CVE-2026-59186
Received Received - Intake

Heap Out-of-Bounds Write in OpenEXR TiledRgbaInputFile

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 tile size. On ILP32, the Array2D<Rgba> tile-conversion buffer size calculation overflows, allocates a much smaller heap buffer, and tile decode writes past that allocation. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-59186
EUVD
EUVD-2026-65584

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation openexr to 3.4.13 (inc)
academysoftwarefoundation openexr 3.2.11
academysoftwarefoundation openexr 3.3.13
academysoftwarefoundation openexr 3.4.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59186 is a heap out-of-bounds write vulnerability in OpenEXR, affecting 32-bit/ILP32 builds. It occurs when processing a crafted tiled EXR file with a small data window but an extremely large tile size (65537x65537). The vulnerability stems from an integer overflow during buffer size calculation in the Array2D class, where 32-bit arithmetic causes undersized memory allocation. This leads to memory corruption when tile decoding writes beyond the allocated buffer.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable OpenEXR versions and analyzing EXR files for malicious tile sizes. Use 'exrheader' or 'exrinfo' tools from OpenEXR to inspect EXR files for unusually large tile dimensions (e.g., 65537x65537). Check installed OpenEXR versions with 'pkg-config --modversion OpenEXR' or 'dpkg -l | grep openexr'.

Impact Analysis

This vulnerability can cause crashes or memory corruption in applications using vulnerable OpenEXR versions on 32-bit systems. Attackers could exploit it by supplying malicious EXR files, potentially leading to denial-of-service or arbitrary code execution. The impact is limited to 32-bit/ILP32 builds and does not affect 64-bit systems.

Compliance Impact

This vulnerability primarily impacts system integrity and availability due to potential memory corruption and crashes in 32-bit applications processing EXR files. While not directly violating GDPR or HIPAA, it could indirectly affect compliance by enabling data corruption or unauthorized access if exploited. Organizations handling sensitive data in affected environments should prioritize patching to maintain system reliability and security.

Mitigation Strategies

Upgrade OpenEXR to patched versions (3.2.11, 3.3.13, or 3.4.14). If upgrading is not possible, avoid processing untrusted EXR files, especially those with large tile sizes. Disable or restrict applications using vulnerable OpenEXR builds until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59186. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart