Cloudanix VulnDB

CVE-2026-59983

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Aug 25, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in image software used for movies can make programs crash when they open certain specially made files, interrupting creative work.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in OpenEXRCore decoding.c on ILP32 builds when a crafted uncompressed deep-tile EXR causes sample-count table size calculation to wrap before unpack_sample_table() processes attacker-controlled tile dimensions, resulting in denial of service.

Why it matters to the business

Applications handling EXR images in the motion picture industry may crash during rendering or compositing workflows, causing downtime, lost productivity, and potential disruption to production pipelines until vulnerable libraries are updated.

How an attack unfolds

An attacker creates a malicious uncompressed deep-tile EXR file with manipulated dimensions that trigger integer wraparound during sample-count table size calculation. When a vulnerable application processes the file on an ILP32 build, the library performs an out-of-bounds read and crashes.

How to fix it

Upgrade OpenEXR to version 3.2.11, 3.3.13, or 3.4.14 or later across all affected installations and rebuild dependent applications.

How to confirm the fix worked

Confirm OpenEXR version meets or exceeds 3.2.11, 3.3.13, or 3.4.14. Reprocess known trigger EXR files in a test environment and verify no crash or memory error occurs.

Typical attack path

  1. Craft malicious uncompressed deep-tile EXR file with oversized dimensions to induce wraparound
  2. Deliver the file to a target system through email, web download, or shared storage
  3. Victim application loads and decodes the EXR using the vulnerable OpenEXR library on ILP32
  4. Out-of-bounds read occurs during unpack_sample_table processing, triggering denial of service

How to detect it

Review application and system logs for crashes or segmentation faults during EXR file processing; correlate with file ingestion timestamps in VFX or rendering pipelines.

What your security team should do

  • Prioritize upgrade of OpenEXR to fixed versions 3.2.11, 3.3.13, or 3.4.14
  • Inventory all software and containers depending on OpenEXR and schedule immediate updates
  • Restrict processing of untrusted EXR files until patches are applied

The record

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds read. The vulnerability is reached when a crafted uncompressed deep-tile EXR causes the sample-count table size calculation in OpenEXRCore decoding.c to wrap before unpack_sample_table() iterates over the full attacker-controlled tile dimensions, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities