CVE-2026-59186highCWE-122CWE-190CWE-787

CVE-2026-59186: high-severity vulnerability in AcademySoftwareFoundation openexr

OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds

Published

Follow this CVE+ Monitor openexr+ Monitor openexr

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.3%
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 tile size. On ILP32, the Array2D<Rgba> tile-conversion buffer size calculation overflows, allocates a much smaller heap buffer, and tile decode writes past that allocation. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Affected products
AcademySoftwareFoundation · openexr
Related CVEs — AcademySoftwareFoundation openexr

In the same product, most dangerous first.

CVE-2026-34545HIGHOpenEXR: integer overflow lead to OOB in HTJ2K decoderEPSS 0.6%CVE-2026-26981MEDIUMOpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cppEPSS 0.6%CVE-2025-48072MEDIUMOpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds HeapEPSS 0.6%CVE-2026-34543HIGHOpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)EPSS 0.5%CVE-2026-34588HIGHOpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/WriteEPSS 0.5%CVE-2026-42216HIGHOpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansionEPSS 0.5%