CVE-2026-59189

Name of the Vulnerable Software and Affected Versions OpenEXRUtil versions 3.3.0 through 3.3.12 OpenEXRUtil versions 3.4.0 through 3.4.12

Description The TypedDeepImageChannel<T>::row() API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin. This occurs because ImfDeepImageChannel utilizes two conflicting coordinate models: at(x, y) uses absolute coordinates, while row(r) is documented for 0-based logical access. Consequently, if dataWindow.min is non-zero, row(0) points outside the sampleListPointers allocation rather than the first logical row. This leads to a heap out-of-bounds read and crash, which may allow information disclosure under a controlled heap layout.

Recommendations Update versions 3.3.0 through 3.3.12 to version 3.3.13. Update versions 3.4.0 through 3.4.12 to version 3.4.13.