Every CVE Search/ Get API key

CVE-2026-59187

OpenEXR: exrmetrics deep pixelmode heap buffer overflow

7.1 HighFix available

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.40%Up 0.2 points since Aug 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

OpenEXR: exrmetrics deep pixelmode heap buffer overflow

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

Record
CVE-2026-59187
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
EUVDEUVD-2026-65589 7.1

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

Record
EUVD-2026-65589
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
NVD 7.1

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

Record
CVE-2026-59187
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2026-59187 7.1

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

Record
ALPINE-CVE-2026-59187
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-03
OSVBELL-CVE-2026-59187 7.1
Record
BELL-CVE-2026-59187
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSV 7.1

OpenEXR: exrmetrics deep pixelmode heap buffer overflow

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

Record
CVE-2026-59187
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2026-59187 7.1

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

Record
DEBIAN-CVE-2026-59187
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-07
OSVUBUNTU-CVE-2026-59187 7.1

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

Record
UBUNTU-CVE-2026-59187
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:11612-1 No score

libIex-3_4-33-3.4.14-1.1 on GA media

These are all security issues fixed in the libIex-3_4-33-3.4.14-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11612-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12184-1 No score

python313-OpenEXR-3.4.16-1.1 on GA media

These are all security issues fixed in the python313-OpenEXR-3.4.16-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12184-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-59187 No score

CVE-2026-59187 in openexr - Patched by Root

Root has patched CVE-2026-59187 in the openexr package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-59187
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-59187 No score

CVE-2026-59187 in openexr - Patched by Root

Root has patched CVE-2026-59187 in the openexr package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-59187
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-59187 No score

CVE-2026-59187 in openexr - Patched by Root

Root has patched CVE-2026-59187 in the openexr package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-59187
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openexr
Alpine:v3.24
 before 3.4.15-r0
3.4.15-r0
openexr
Alpaquita:stream
 3.4.4-r0 up to 3.4.15-r0
3.4.15-r0
openexr
Debian:12
 All versions, plus listed versions
3.1.13-13.1.13-23.1.5-53.1.5-5.13.1.5-5.1+hurd.1
Show 8 moreShow less
3.4.14-0.13.4.15+ds-13.4.16+ds-13.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-43.5.2+ds-1
 None known
openexr
Debian:14
 before 3.4.14-0.1, plus listed versions
3.1.13-23.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-4
3.4.14-0.1
openexr
Root:Debian:11
 before 2.5.4-2+deb11u1.aikido.18
2.5.4-2+deb11u1.aikido.18
rootio-openexr
Root:Debian:11
 before 2.5.4-2+deb11u1.aikido.18
2.5.4-2+deb11u1.aikido.18
openexr
Root:Debian:12
 before 3.1.5-5.aikido.25
3.1.5-5.aikido.25
rootio-openexr
Root:Debian:12
 before 3.1.5-5.aikido.25
3.1.5-5.aikido.25
openexr
Root:Debian:13
 before 3.1.13-2.aikido.15
3.1.13-2.aikido.15
rootio-openexr
Root:Debian:13
 before 3.1.13-2.aikido.15
3.1.13-2.aikido.15
Show 9 moreShow less
Affected packages
PackageAffectedFixed
openexr
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.2.0-1ubuntu32.2.0-7ubuntu12.2.0-9ubuntu12.2.0-10ubuntu22.2.0-10ubuntu2.1
Show 8 moreShow less
2.2.0-10ubuntu2.22.2.0-10ubuntu2.32.2.0-10ubuntu2.42.2.0-10ubuntu2.62.2.0-10ubuntu2.6+esm12.2.0-10ubuntu2.6+esm22.2.0-10ubuntu2.6+esm32.2.0-10ubuntu2.6+esm4
 None known
openexr
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.0-11ubuntu12.2.0-11.1ubuntu12.2.0-11.1ubuntu1.12.2.0-11.1ubuntu1.22.2.0-11.1ubuntu1.3
Show 6 moreShow less
2.2.0-11.1ubuntu1.42.2.0-11.1ubuntu1.62.2.0-11.1ubuntu1.72.2.0-11.1ubuntu1.82.2.0-11.1ubuntu1.92.2.0-11.1ubuntu1.9+esm1
 None known
openexr
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.2.1-4.1ubuntu12.3.0-62.3.0-6build12.3.0-6ubuntu0.12.3.0-6ubuntu0.2
Show 4 moreShow less
2.3.0-6ubuntu0.32.3.0-6ubuntu0.52.3.0-6ubuntu0.5+esm12.3.0-6ubuntu0.5+esm2
 None known
openexr
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.5.4-22.5.7-12.5.7-1ubuntu0.1~esm12.5.7-1ubuntu0.1~esm2
 None known
openexr
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.1.5-5.13.1.5-5.1build13.1.5-5.1build23.1.5-5.1build33.1.5-5.1ubuntu0.1~esm1
 None known
openexr
Ubuntu:26.10
 All versions, plus listed versions
3.1.13-2build13.4.6+ds-4ubuntu3
 None known
openexr
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.1.13-23.1.13-2build13.1.13-2ubuntu0.26.04.1~esm1
 None known
openexr
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 3.4.14-1.1
3.4.14-1.1
python-OpenEXR
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 3.4.16-1.1
3.4.16-1.1

History

History
RecordedChangedSources
affectedOSV
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-59187 is a high vulnerability (CVSS 7.1) in Academysoftwarefoundation Openexr, published August 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in openexr 3.4.15-r0.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open