CVE-2026-59982: OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.3.13 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.4.14
Event History
Frequently Asked Questions
Which OpenEXR releases are affected, and which releases contain the fix?
Affected releases are versions before 3.2.11, versions 3.3.0 through 3.3.12, and versions 3.4.0 through 3.4.13. Upgrade to 3.2.11, 3.3.13, or 3.4.14, as appropriate for the release branch in use.
What must occur for exploitation to be possible?
A crafted deep EXR file with a nonzero dataWindow origin must be processed in a way that reaches TypedDeepImageChannel::row(). The vulnerability can cause a crash or limited information disclosure.
How can I determine whether an application is exposed?
Identify applications using an affected OpenEXR version and determine whether they process deep EXR files from potentially untrusted sources. Files with a nonzero dataWindow origin are the relevant triggering condition described for this issue.