VDB
CVE-2026-59187
CVE-2026-59187
PUBLISHED
CVSS 7.1 HIGH
Reported by GitHub_M · Published August 25, 2026
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.
Risk Scores
CVSS 3.1
7.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.3.0, < 3.3.13, >= 3.4.0, < 3.4.14 |
| alpine | openexr | 0, 0, 0 |
| AcademySoftwareFoundation | openexr | >= 3.3.0, < 3.3.13, >= 3.4.0, < 3.4.14 |
Timeline
- Aug 25, 2026 Coalition ESS Score
- Aug 25, 2026 CVE Published
- Aug 26, 2026 EPSS Score
- Sep 2, 2026 Security Advisory
- Sep 9, 2026 EPSS Score
- Sep 9, 2026 CVE Updated
- Sep 12, 2026 EPSS Score
- Sep 17, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-6jj8-cxcr-j8hm x_refsource_CONFIRM
- https://github.com/AcademySoftwareFoundation/openexr/commit/46e70220dc91dbc1341fac4671704e970b450585 x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/commit/7e772dd704b9b5d6dc2564647d89f7813f608e94 x_refsource_MISC