CVE-2026-59981
Received Received - Intake

Out-of-Bounds Read in OpenEXR Deep Image Processing

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::row() API when a deep image has a non-zero dataWindow origin. The row() accessor is documented as 0-based and computes its address from an internal base that is offset for absolute pixel coordinates, so the two coordinate models conflict whenever dataWindow.min is non-zero. For a deep image whose data window has a large negative vertical origin, row(0) points far outside the allocated sample-count buffer. An application that opens an attacker-controlled deep EXR file and accesses sample counts through row() performs an out-of-bounds read, which can crash the process or, under a controlled heap layout, return adjacent heap memory as sample-count values. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-26
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-59981
EUVD
EUVD-2026-65746

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation openexr 2.*
academysoftwarefoundation openexr 3.0.*
academysoftwarefoundation openexr 3.1.*
academysoftwarefoundation openexr to 3.2.11 (exc)
academysoftwarefoundation openexr to 3.3.13 (exc)
academysoftwarefoundation openexr to 3.4.14 (exc)
openexr openexr From 3.0.0 (inc) to 3.2.11 (exc)
openexr openexr From 3.3.0 (inc) to 3.3.13 (exc)
openexr openexr From 3.4.0 (inc) to 3.4.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read issue in the OpenEXR library. It occurs in the SampleCountChannel::row() API when processing deep EXR image files with a non-zero data window origin. The API incorrectly calculates memory addresses, leading to reads outside allocated buffers. This can crash applications or expose adjacent heap memory.

Detection Guidance

Detecting this vulnerability requires checking the installed version of OpenEXR. Use commands like 'exrheader --version' or 'dpkg -l | grep openexr' on Linux to verify if your system uses a vulnerable version (through 3.2.10, 3.3.0-3.3.12, or 3.4.0-3.4.13). Inspect files processed by applications using OpenEXR for deep image formats.

Impact Analysis

If you use software that relies on OpenEXR to process deep EXR files, an attacker could exploit this flaw by providing a maliciously crafted file. This might cause crashes, data leaks, or allow arbitrary code execution depending on the heap layout. Users of affected applications should update to patched versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is a technical flaw in the OpenEXR library that could lead to crashes or information disclosure due to out-of-bounds memory reads. Compliance impacts would depend on how the affected software is used in systems subject to these regulations.

Mitigation Strategies

Upgrade OpenEXR to a patched version (3.2.11, 3.3.13, or 3.4.14) immediately. Disable or restrict access to applications processing deep EXR files until patched. Monitor for crashes or unusual behavior in OpenEXR-utilizing software when handling deep images.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59981. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart