VDB
CVE-2026-59984
CVE-2026-59984
PUBLISHED
CVSS 5.5 MEDIUM
Reported by GitHub_M · Published August 25, 2026
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.1.0, < 3.2.11, >= 3.3.0, < 3.3.13, >= 3.4.0, < 3.4.14 |
| alpine | openexr | 0, 0, 0 |
| AcademySoftwareFoundation | openexr | >= 3.1.0, < 3.2.11, >= 3.3.0, < 3.3.13, >= 3.4.0, < 3.4.14 |
Timeline
- Aug 25, 2026 Coalition ESS Score
- Aug 25, 2026 CVE Published
- Aug 25, 2026 CVE Updated
- Aug 26, 2026 EPSS Score
- Sep 2, 2026 Security Advisory
- Sep 12, 2026 EPSS Score
- Sep 17, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Oct 7, 2026 EPSS Score
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-92pq-9qv4-g68q x_refsource_CONFIRM
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11 x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13 x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14 x_refsource_MISC