CVE-2026-59183

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.1.0 through 3.2.10 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13

Description An integer overflow occurs during an int32 t multiplication within the unpack sample table() function of OpenEXRCore when decoding a specially crafted deep tiled EXR file. This overflow happens in the standard decoding path exr decoding run, resulting in an invalid pointer that causes a read from an unmapped memory address and a subsequent application crash.

Recommendations Update versions 3.1.0 through 3.2.10 to version 3.2.11. Update versions 3.3.0 through 3.3.12 to version 3.3.13. Update versions 3.4.0 through 3.4.13 to version 3.4.14.