CVE-2026-59985
Received Received - Intake

Heap Out-of-Bounds Read in OpenEXR

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-59985
EUVD
EUVD-2026-65695

Affected Vendors & Products

Showing 12 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation openexr From 3.2.0 (inc) to 3.2.10 (inc)
academysoftwarefoundation openexr From 3.3.0 (inc) to 3.3.12 (inc)
academysoftwarefoundation openexr From 3.4.0 (inc) to 3.4.13 (inc)
academysoftwarefoundation openexr 3.2.11
academysoftwarefoundation openexr 3.3.13
academysoftwarefoundation openexr 3.4.14
openexr openexr From 3.2.0 (inc) to 3.2.10 (inc)
openexr openexr From 3.3.0 (inc) to 3.3.12 (inc)
openexr openexr From 3.4.0 (inc) to 3.4.13 (inc)
openexr openexr 3.2.11
openexr openexr 3.3.13
openexr openexr 3.4.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59985 is a heap out-of-bounds read vulnerability in OpenEXR affecting ILP32 (32-bit) builds. It occurs during RLE decompression of crafted EXR files where a maliciously crafted file triggers a heap buffer overflow. The issue arises when a 64-bit size value is truncated during allocation but decompression still processes the full width, causing out-of-bounds memory access and crashes.

Detection Guidance

To detect this vulnerability, check if your system runs OpenEXR on ILP32 (32-bit) builds. Inspect installed versions with commands like 'exrheader --version' or 'dpkg -l | grep openexr' on Linux. Look for versions 3.2.0-3.2.10, 3.3.0-3.3.12, or 3.4.0-3.4.13. Use AddressSanitizer or UndefinedBehaviorSanitizer during compilation to detect heap out-of-bounds reads when processing EXR files.

Impact Analysis

This vulnerability can cause denial of service by crashing applications processing untrusted EXR files on 32-bit systems. It may lead to SIGSEGV errors and is exploitable without user interaction beyond opening a malicious file. 64-bit systems are not affected.

Compliance Impact

This vulnerability primarily causes denial of service through crashes, which may impact availability of systems processing EXR files. It does not directly lead to data disclosure or arbitrary code execution based on provided context. Compliance impact would depend on whether availability is a critical requirement under standards like GDPR or HIPAA, but no specific compliance violations are described in the given data.

Mitigation Strategies

Upgrade OpenEXR to patched versions 3.2.11, 3.3.13, or 3.4.14 immediately. Avoid processing untrusted EXR files on 32-bit systems until patched. Disable or sandbox applications using OpenEXR for ILP32 builds. Monitor for crashes or SIGSEGV errors during EXR file processing as potential exploitation signs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59985. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart