CVE-2026-59983: OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds read. The vulnerability is reached when a crafted uncompressed deep-tile EXR causes the sample-count table size calculation in OpenEXRCore decoding.c to wrap before unpacksampletable() iterates over the full attacker-controlled tile dimensions, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.3.13 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.4.14
Event History
Frequently Asked Questions
Which deployments are affected?
Only ILP32 builds are affected. Vulnerable releases are those before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13.
What does an attacker need to trigger the issue?
An attacker needs to provide a crafted uncompressed deep-tile EXR file. Exploitation requires a user or application to process that file, and can cause denial of service.
How can I remediate this vulnerability?
Upgrade to OpenEXR 3.2.11, 3.3.13, or 3.4.14, depending on the release branch in use.