CVE-2026-59189: OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel<T>::row() API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin, resulting in a heap out-of-bounds read and crash, with potential information disclosure under a controlled heap layout. The flaw arises because ImfDeepImageChannel uses two conflicting coordinate models: at(x, y) uses absolute coordinates (with base offset by dataWindow.min), while row(r) is documented as 0-based logical access. For a non-zero dataWindow.min, row(0) therefore points outside the sampleListPointers allocation instead of at the first logical row. This issue is fixed in versions 3.3.13 and 3.4.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXR (ImfDeepImageChannel / TypedDeepImageChannel<T>)to a version that resolves this vulnerability.Fixed in 3.3.13 - Upgrade
Upgrade
OpenEXR (ImfDeepImageChannel / TypedDeepImageChannel<T>)to a version that resolves this vulnerability.Fixed in 3.4.13
Event History
Frequently Asked Questions
Which deployments are affected?
OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12 are affected when the documented TypedDeepImageChannel<T>::row() API is used with a deep image whose dataWindow origin is non-zero.
What is required to trigger the issue?
The vulnerable condition requires a deep image with a non-zero dataWindow.min value and use of row() for logical row access. In that case, row(0) can point outside the sample-list-pointer allocation.
What is the impact of successful triggering?
The issue can cause a heap out-of-bounds read and crash. Under a controlled heap layout, it may also permit information disclosure.
How can the issue be remediated?
Upgrade to OpenEXRUtil 3.3.13 or 3.4.13, which contain the fix. The provided data does not identify a workaround for affected versions.