CVE-2026-59187

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13

Description A heap out-of-bounds write occurs when the exrmetrics tool processes a specially crafted deep scanline EXR file. This happens when using pixel conversion options such as --pixelmode float or --bench, as the DeepSlice function requests FLOAT output while the backing sample buffers are allocated using the input HALF element size.

Recommendations Update OpenEXR versions 3.3.0 through 3.3.12 to version 3.3.13. Update OpenEXR versions 3.4.0 through 3.4.13 to version 3.4.14.