CVE-2026-59981

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13

Description The OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::row() API when a deep image has a non-zero dataWindow origin. This occurs because the row() accessor is 0-based but computes its address from an internal base offset for absolute pixel coordinates, causing a conflict when dataWindow.min is non-zero. If a deep image has a large negative vertical origin, row(0) points outside the allocated sample-count buffer. An application processing a malicious deep EXR file may perform an out-of-bounds read, potentially leading to a process crash or the disclosure of adjacent heap memory.

Recommendations Update to version 3.2.11. Update to version 3.3.13. Update to version 3.4.14.