Out-of-Bounds Write Vulnerability in OpenEXR by Academy Software Foundation
CVE-2026-59984
5.5MEDIUM
What is CVE-2026-59984?
OpenEXR is a widely utilized image format in the motion picture industry, and certain versions are susceptible to an out-of-bounds write vulnerability. This flaw arises in ILP32 builds when a specially crafted B44-compressed scanline EXR is processed. It causes the logical scratch size to truncate before memory allocation, leading to a potential denial of service and memory corruption when the 'uncompress_b44_impl()' function writes beyond allocated boundaries. Users are encouraged to upgrade to versions 3.2.11, 3.3.13, or 3.4.14 to mitigate this issue.
Affected Version(s)
openexr >= 3.1.0, < 3.2.11 < 3.1.0, 3.2.11
openexr >= 3.3.0, < 3.3.13 < 3.3.0, 3.3.13
openexr >= 3.4.0, < 3.4.14 < 3.4.0, 3.4.14