VDB
CVE-2026-59985
CVE-2026-59985
PUBLISHED
CVSS 5.5 MEDIUM
Reported by GitHub_M · Published August 25, 2026
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.2.0, < 3.2.11, >= 3.3.0, < 3.3.13, >= 3.4.0, < 3.4.14 |
| alpine | openexr | 0, 0, 0 |
| AcademySoftwareFoundation | openexr | >= 3.2.0, < 3.2.11, >= 3.3.0, < 3.3.13, >= 3.4.0, < 3.4.14 |
Timeline
- Aug 25, 2026 CVE Published
- Aug 26, 2026 EPSS Score
- Aug 26, 2026 Coalition ESS Score
- Sep 2, 2026 Security Advisory
- Sep 9, 2026 CVE Updated
- Sep 12, 2026 EPSS Score
- Sep 17, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Oct 7, 2026 EPSS Score
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm x_refsource_CONFIRM
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11 x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13 x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14 x_refsource_MISC