CVE-2026-59985: OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.3.13 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.4.14
Event History
Frequently Asked Questions
Which deployments are affected?
Only ILP32 builds are affected. The vulnerable release ranges are 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13.
What is required to trigger the issue?
An attacker needs to cause the affected application to decode a crafted RLE-compressed EXR file. User interaction is required, and the reported impact is denial of service.
How can this be remediated?
Upgrade to OpenEXR 3.2.11, 3.3.13, or 3.4.14, as appropriate for the release branch in use.