Medium severity · published Aug 25, 2026
CVE-2026-59183
OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, an int32_t multiplication in OpenEXRCore's unpack_sample_table() can overflow while decoding a crafted deep tiled EXR file, producing an invalid pointer that leads to a read from an unmapped memory address and a crash. Because the overflow occurs in the standard decoding path (exr_decoding_run), any application that decodes deep tiled EXR files is affected. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openexr · AcademySoftwareFoundation
>= 3.1.0, < 3.2.11; >= 3.3.0, < 3.3.13; >= 3.4.0, < 3.4.14 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59183
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59183
github.com
https://github.com/AcademySoftwareFoundation/openexr/commit/5e55a64ad1f119a8166542f4b6e034c31b7e043a
github.com
https://github.com/AcademySoftwareFoundation/openexr/commit/a6cf183725b5665ac3fdbec640125fba5ee1ab39
github.com
https://github.com/AcademySoftwareFoundation/openexr/commit/e2adb5be3bbc3a1f82f2bc06cc9699995a99a607
github.com
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-rqp5-pmwm-wj6x
More from openexr
9.8
CVE-2026-42217
OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)
9.1
CVE-2026-42216
OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
9.1
CVE-2025-48072
OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap
8.8
CVE-2026-41142
OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
7.8
CVE-2026-34588
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write