CVE-2026-59184: OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application writes rows through FlatHalfChannel::row(). Affected consumers are tools, converters, render pipeline components, or image-processing services that accept untrusted EXR files and use FlatHalfChannel::row() on loaded images. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.3.13 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.4.14
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Tools, converters, render-pipeline components, and image-processing services are affected when they accept untrusted EXR files and write loaded image rows through FlatHalfChannel::row(). The vulnerable condition is a crafted EXR whose dataWindow.min is nonzero.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and user interaction required. The provided details identify crafted EXR input as the exploitation mechanism.
Which OpenEXR releases should be used to remediate the issue?
Upgrade to OpenEXR 3.2.11, 3.3.13, or 3.4.14. Affected releases are versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13.
What can be done if an upgrade cannot be applied immediately?
Avoid accepting untrusted EXR files in affected processing paths, particularly paths that use FlatHalfChannel::row() on loaded images. Restricting such inputs reduces exposure to crafted files with a nonzero dataWindow.min.