VDB
CVE-2026-59183
CVE-2026-59183
PUBLISHED
CVSS 5.5 MEDIUM
Reported by GitHub_M · Published August 25, 2026
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, an int32_t multiplication in OpenEXRCore's unpack_sample_table() can overflow while decoding a crafted deep tiled EXR file, producing an invalid pointer that leads to a read from an unmapped memory address and a crash. Because the overflow occurs in the standard decoding path (exr_decoding_run), any application that decodes deep tiled EXR files is affected. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.1.0, < 3.2.11, >= 3.3.0, < 3.3.13, >= 3.4.0, < 3.4.14 |
| alpine | openexr | 0, 0, 0 |
| AcademySoftwareFoundation | openexr | >= 3.1.0, < 3.2.11, >= 3.3.0, < 3.3.13, >= 3.4.0, < 3.4.14 |
Timeline
- Aug 25, 2026 EPSS Score
- Aug 25, 2026 Coalition ESS Score
- Aug 25, 2026 CVE Published
- Sep 3, 2026 Security Advisory
- Sep 5, 2026 EPSS Score
- Sep 9, 2026 CVE Updated
- Sep 16, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Oct 7, 2026 EPSS Score
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-rqp5-pmwm-wj6x x_refsource_CONFIRM
- https://github.com/AcademySoftwareFoundation/openexr/commit/5e55a64ad1f119a8166542f4b6e034c31b7e043a x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/commit/a6cf183725b5665ac3fdbec640125fba5ee1ab39 x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/commit/e2adb5be3bbc3a1f82f2bc06cc9699995a99a607 x_refsource_MISC