CVE-2026-59187
Received Received - Intake

Heap Out-of-Bounds Write in OpenEXR

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-59187
EUVD
EUVD-2026-65589

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation openexr From 3.3.0 (inc) to 3.3.13 (exc)
academysoftwarefoundation openexr From 3.4.0 (inc) to 3.4.14 (exc)
openexr openexr From 3.3.0 (inc) to 3.3.12 (inc)
openexr openexr From 3.4.0 (inc) to 3.4.13 (inc)
openexr openexr 3.3.13
openexr openexr 3.4.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59187 is a heap out-of-bounds write vulnerability in OpenEXR's exrmetrics tool. It occurs when processing crafted deep scanline EXR files with HALF channel samples while using pixel type conversion options like --pixelmode float or --bench. The tool incorrectly allocates sample buffers based on input HALF (2-byte) sizes but writes FLOAT (4-byte) values, causing memory corruption.

Detection Guidance

To detect this vulnerability, check the installed OpenEXR version using commands like 'exrmetrics --version' or 'dpkg -l | grep openexr'. If the version is between 3.3.0-3.3.12 or 3.4.0-3.4.13, the system is vulnerable. Use sanitizers like AddressSanitizer or UndefinedBehaviorSanitizer to detect heap buffer overflows during exrmetrics operations with crafted EXR files.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code or cause denial-of-service by corrupting memory when processing malicious EXR files. It may lead to crashes, data corruption, or unauthorized system access if exploited. Users processing untrusted EXR files with affected OpenEXR versions are at risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling memory corruption through heap buffer overflows. Such flaws may lead to unauthorized data access, modification, or denial of service, which are critical risks under these regulations. However, specific compliance impacts depend on how OpenEXR is used in systems handling regulated data.

Mitigation Strategies

Upgrade OpenEXR to versions 3.3.13 or 3.4.14 or later. Avoid using exrmetrics with --pixelmode float or --bench options on untrusted EXR files. If upgrading is not immediately possible, restrict access to exrmetrics or disable deep scanline processing in OpenEXR until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart