Heap Pointer Vulnerability in OpenEXR Affecting Image Processing Tools
CVE-2026-59184
7.1HIGH
What is CVE-2026-59184?
OpenEXR, the popular reference implementation for the EXR image format, is susceptible to a vulnerability that can be exploited in applications handling EXR files. Specifically, a crafted EXR file with a non-zero dataWindow.min can lead TypedFlatImageChannel::row() to return an invalid heap pointer. This presents risks of out-of-bounds writes or use-after-free conditions occurring when certain applications apply the FlatHalfChannel::row() function on loaded images. Tools, converters, and rendering pipeline components that process untrusted EXR files are particularly at risk. This issue has been resolved in recent software updates.
Affected Version(s)
openexr < 3.2.11 < 3.2.11
openexr >= 3.3.0, < 3.3.13 < 3.3.0, 3.3.13
openexr >= 3.4.0, < 3.4.14 < 3.4.0, 3.4.14