CVE-2026-59183: OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, an int32t multiplication in OpenEXRCore's unpacksampletable() can overflow while decoding a crafted deep tiled EXR file, producing an invalid pointer that leads to a read from an unmapped memory address and a crash. Because the overflow occurs in the standard decoding path (exrdecodingrun), any application that decodes deep tiled EXR files is affected. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.3.13 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.4.14
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using affected OpenEXR versions that decode deep tiled EXR files are exposed. The vulnerable operation occurs in the standard decoding path, exr_decoding_run.
What does an attacker need to exploit the vulnerability?
An attacker needs to cause the application to decode a crafted deep tiled EXR file. The supplied severity vector indicates local attack vector and user interaction is required; no privileges are required.
What is the expected impact of successful exploitation?
The integer overflow can produce an invalid pointer and cause a read from unmapped memory, resulting in an application crash. The provided impact vector indicates availability impact only, with no confidentiality or integrity impact.
Which versions should be used to remediate the issue?
Update to OpenEXR 3.2.11, 3.3.13, or 3.4.14. Affected ranges are 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13.