Buffer Overflow Vulnerability in OpenEXR Core Affecting Multiple Versions
CVE-2026-59183
5.5MEDIUM
What is CVE-2026-59183?
A buffer overflow vulnerability exists in OpenEXR Core's unpack_sample_table() function for certain versions. This vulnerability arises from an integer multiplication overflow when decoding crafted deep tiled EXR files, which can lead to reading from unmapped memory addresses. As this overflow occurs within the standard decoding pathway (exr_decoding_run), all applications utilizing OpenEXR for deep tiled EXR file decoding are potentially at risk. The vulnerability has been addressed in subsequent releases, encouraging users to upgrade to the latest versions.
Affected Version(s)
openexr >= 3.1.0, < 3.2.11 < 3.1.0, 3.2.11
openexr >= 3.3.0, < 3.3.13 < 3.3.0, 3.3.13
openexr >= 3.4.0, < 3.4.14 < 3.4.0, 3.4.14