CVE-2026-59186: OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 tile size. On ILP32, the Array2D<Rgba> tile-conversion buffer size calculation overflows, allocates a much smaller heap buffer, and tile decode writes past that allocation. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.3.13 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.4.14
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only 32-bit/ILP32 builds are affected, and exploitation requires an application to read attacker-controlled tiled EXR files through the public TiledRgbaInputFile RGBA API. The issue is network-reachable only where untrusted EXR content can reach that parsing path.
What does an attacker need to provide?
An attacker needs to convince a user or application to process a crafted tiled EXR file. The malformed file uses a small 40x40 dataWindow with a 65537x65537 tile size, causing an integer overflow in the tile-conversion buffer calculation on ILP32 builds.
Which versions contain the fix?
The issue is fixed in OpenEXR 3.2.11, 3.3.13, and 3.4.14. Affected releases are versions before 3.2.11, versions 3.3.0 through 3.3.12, and versions 3.4.0 through 3.4.13.