Heap Out-of-Bounds Read Vulnerability in OpenEXR from Academy Software Foundation
CVE-2026-59189
What is CVE-2026-59189?
The OpenEXR image format, widely utilized in the motion picture industry, is affected by a vulnerability in the TypedDeepImageChannel::row() API. In versions spanning 3.3.0 to 3.3.12 and 3.4.0 to 3.4.12, this API may inadvertently return an out-of-bounds pointer when manipulating deep images with non-zero dataWindow origins. This mismanagement arises due to the conflicting coordinate systems employed by the ImfDeepImageChannel class, leading to possible heap out-of-bounds reads, crashes, and potential information exposure in scenarios where the heap is intentionally manipulated. Users are urged to upgrade to versions 3.3.13 or 3.4.13 to mitigate this issue. For further details, refer to the provided advisory and commit links.
Affected Version(s)
openexr < 3.2.11 < 3.2.11
openexr >= 3.3.0, < 3.3.13 < 3.3.0, 3.3.13
openexr >= 3.4.0, < 3.4.14 < 3.4.0, 3.4.14