CVE-2026-59187: OpenEXR: exrmetrics deep pixelmode heap buffer overflow
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.3.13 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.4.14
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems that run the OpenEXR exrmetrics tool on untrusted or attacker-controlled deep scanline EXR files are exposed, provided they use affected OpenEXR releases and relevant pixel conversion options.
What does an attacker need to trigger the issue?
An attacker needs to supply a crafted deep scanline EXR file and have exrmetrics process it with pixel conversion behavior that requests FLOAT output, such as --pixelmode float or --bench. The vector is network-accessible in the CVSS assessment, but user interaction is required to cause the file to be processed.
Which versions should be remediated?
OpenEXR 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are affected. Upgrade to 3.3.13 or 3.4.14, respectively.
What can be done if an upgrade is not immediately possible?
Do not run exrmetrics against untrusted deep scanline EXR files, particularly with --pixelmode float or --bench. Restrict processing to trusted inputs until the fixed release can be deployed.