CVE-2026-59982

What it actually does

Returns an out-of-bounds pointer from TypedDeepImageChannel::row() when processing a crafted deep EXR image with nonzero dataWindow origin, due to incorrect combination of zero-based row indexing with an absolute-coordinate base pointer, enabling crash or limited memory disclosure.

Why it matters to the business

Processing untrusted EXR images in VFX, animation, or film pipelines can trigger application crashes causing workflow disruption and potential limited data leakage from memory, affecting production continuity in media industries that depend on the OpenEXR format.

How an attack unfolds

An attacker creates a malicious deep EXR file with a nonzero dataWindow origin, then delivers it to a target who opens it in vulnerable software; the library's row() access path dereferences an invalid pointer, resulting in denial of service or exposure of adjacent memory contents.

How to fix it

Upgrade OpenEXR to version 3.2.11 or later, 3.3.13 or later, or 3.4.14 or later; rebuild and redeploy any dependent applications or libraries; validate the update by confirming the corrected row() implementation.

How to confirm the fix worked

Inventory all OpenEXR installations and linked binaries, compare reported versions against 3.2.11/3.3.13/3.4.14, and test processing of known-good and crafted EXR samples to confirm absence of the pointer error.

Typical attack path

1. Craft deep EXR file with nonzero dataWindow origin
2. Distribute file via email, web download, or shared storage
3. Victim opens file using application linked to vulnerable OpenEXR
4. TypedDeepImageChannel::row() computes out-of-bounds pointer
5. Application crashes or leaks limited memory contents

How to detect it

Review application crash logs and memory sanitizer reports for segmentation faults or invalid pointer accesses during EXR file parsing; correlate with file-open events involving .exr extensions from external sources.

What your security team should do

• Prioritize upgrade of OpenEXR across all build pipelines within 30 days given 62 days of public disclosure
• Add OpenEXR version checks to dependency scanners and CI gates
• Temporarily disable deep EXR import from untrusted sources until patches are applied
• Monitor crash reports and memory sanitizer output for symptoms matching the row() flaw