CVE-2026-59984
Received Received - Intake

Out-of-Bounds Write in OpenEXR ILP32 Builds

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-59984
EUVD
EUVD-2026-65693

Affected Vendors & Products

Showing 14 associated CPEs
Vendor Product Version / Range
openexr openexr From 3.1.0 (inc) to 3.2.10 (inc)
openexr openexr From 3.3.0 (inc) to 3.3.12 (inc)
openexr openexr From 3.4.0 (inc) to 3.4.13 (inc)
openexr openexr 3.2.11
openexr openexr 3.3.13
openexr openexr 3.4.14
academysoftwarefoundation openexr From 3.1.0 (inc) to 3.4.14 (exc)
academysoftwarefoundation openexr to 3.2.11 (exc)
academysoftwarefoundation openexr 3.2.11
academysoftwarefoundation openexr From 3.3.0 (inc) to 3.4.14 (exc)
academysoftwarefoundation openexr to 3.4.14 (exc)
academysoftwarefoundation openexr 3.3.13
academysoftwarefoundation openexr From 3.4.0 (inc) to 3.4.14 (exc)
academysoftwarefoundation openexr 3.4.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59984 is an out-of-bounds write vulnerability in OpenEXR affecting 32-bit ILP32 builds. It occurs when a crafted B44-compressed scanline EXR file causes a logical scratch size to truncate before allocation. The decompression function then writes using the attacker-controlled channel width, leading to memory corruption or denial of service.

Detection Guidance

To detect this vulnerability, check the installed OpenEXR version on your system. For Linux, use commands like 'dpkg -l | grep openexr' or 'rpm -qa | grep openexr'. If the version is between 3.1.0 and 3.4.13 on a 32-bit ILP32 build, the system is vulnerable.

Impact Analysis

This vulnerability can cause denial of service through crashes or memory corruption when opening a malicious EXR file. On 32-bit systems, it may allow arbitrary code execution if exploited further. The impact is limited to 32-bit platforms; 64-bit systems are unaffected.

Compliance Impact

This vulnerability primarily impacts system availability and integrity due to crashes and memory corruption on 32-bit systems. It does not directly expose sensitive data or violate GDPR/HIPAA unless combined with other exploits. However, denial of service could disrupt regulated processes, and memory corruption might risk data integrity in affected environments.

Mitigation Strategies

Upgrade OpenEXR to a patched version (3.2.11, 3.3.13, or 3.4.14) immediately. For Linux systems, use package managers like 'apt upgrade openexr' or 'yum update openexr'. Avoid opening untrusted .exr files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59984. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart