CVE-2026-59982

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13

Description An issue exists where the TypedDeepImageChannel::row() function can return an out-of-bounds pointer when processing a crafted deep EXR image with a nonzero dataWindow origin. This occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, which may lead to a crash or limited information disclosure.

Recommendations Update to version 3.2.11. Update to version 3.3.13. Update to version 3.4.14.