CVE-2026-110597: Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory
Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute() bounds checks, crashing applications or leaking adjacent heap memory into attribute values.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using TinyEXR through 3.2.0 are exposed when they parse multi-part EXR files with ParseEXRMultipartHeaderFromMemory(). The relevant risk is greatest where EXR files can come from untrusted sources.
What does an attacker need to exploit the vulnerability?
An attacker needs to provide a crafted multi-part EXR file and have the target application process it. The attack requires user interaction, such as opening or otherwise importing the malicious file.
How can I determine whether my application may be affected?
Check whether the application includes TinyEXR version 3.2.0 or earlier and processes multi-part EXR input. Code paths that call ParseEXRMultipartHeaderFromMemory() are specifically relevant.