CVE-2026-59984: OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompressb44impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.4.14
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are ILP32 builds of OpenEXR using versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, or 3.4.0 through 3.4.13. The issue is triggered while decoding B44-compressed scanline EXR files.
What does an attacker need to exploit this issue?
An attacker needs a crafted B44-compressed scanline EXR file to be decoded by a vulnerable ILP32 build. The supplied severity vector indicates local attack vector, no privileges required, and user interaction required.
What is the impact if exploitation succeeds?
The crafted image can cause an out-of-bounds write in the B44 decompression path, resulting in denial of service and memory corruption. The reported severity vector indicates availability impact, with no reported confidentiality or integrity impact.
Which versions contain fixes?
The issue is fixed in OpenEXR 3.2.11, 3.3.13, and 3.4.14. Upgrading to the applicable fixed release removes the vulnerable versions identified in the advisory.