Heap Out-of-Bounds Write Vulnerability in OpenEXR by Academy Software Foundation
CVE-2026-59186
7.1HIGH
What is CVE-2026-59186?
A vulnerability exists in OpenEXR, the reference implementation for the widely used EXR image format, where a crafted tiled EXR can lead to a heap out-of-bounds write on certain builds. Specifically, when reading through the public TiledRgbaInputFile RGBA API, a small dataWindow is used with an excessively large tile size, causing an overflow in buffer size calculations. This can result in critical memory corruption as tile decoding proceeds beyond allocated limits. The issue affects multiple versions and is mitigated in newer releases.
Affected Version(s)
openexr < 3.2.11 < 3.2.11
openexr >= 3.3.0, < 3.3.13 < 3.3.0, 3.3.13
openexr >= 3.4.0, < 3.4.14 < 3.4.0, 3.4.14