CVE-2026-59983

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13

Description On ILP32 builds, an out-of-bounds read occurs when processing a crafted uncompressed deep-tile EXR. This happens because the sample-count table size calculation in OpenEXRCore decoding.c wraps before the unpack sample table() function iterates over the attacker-controlled tile dimensions, which can lead to a denial of service.

Recommendations Update to version 3.2.11. Update to version 3.3.13. Update to version 3.4.14.