CVE-2026-59184highCWE-416CWE-787

CVE-2026-59184: high-severity vulnerability in AcademySoftwareFoundation openexr

OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write

Published

Follow this CVE+ Monitor openexr+ Monitor openexr

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.2%
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application writes rows through FlatHalfChannel::row(). Affected consumers are tools, converters, render pipeline components, or image-processing services that accept untrusted EXR files and use FlatHalfChannel::row() on loaded images. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Affected products
AcademySoftwareFoundation · openexr
Related CVEs — AcademySoftwareFoundation openexr

In the same product, most dangerous first.

CVE-2026-34545HIGHOpenEXR: integer overflow lead to OOB in HTJ2K decoderEPSS 0.6%CVE-2026-26981MEDIUMOpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cppEPSS 0.6%CVE-2025-48072MEDIUMOpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds HeapEPSS 0.6%CVE-2026-34588HIGHOpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/WriteEPSS 0.5%CVE-2026-34543HIGHOpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)EPSS 0.5%CVE-2026-42216HIGHOpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansionEPSS 0.5%