CVE-2026-59184

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13

Description A crafted EXR file with a nonzero dataWindow.min can cause the TypedFlatImageChannel::row() function to return an invalid heap pointer. This leads to out-of-bounds or use-after-free writes when an application writes rows through the FlatHalfChannel::row() function. This issue affects tools, converters, render pipeline components, or image-processing services that process untrusted EXR files using the FlatHalfChannel::row() function.

Recommendations Update to version 3.2.11. Update to version 3.3.13. Update to version 3.4.14.