Every CVE Search/ Get API key

CVE-2026-59985

OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32

5.5 MediumFix available

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.17%Unchanged since Aug 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.5

OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Record
CVE-2026-59985
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-65695 5.5

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Record
EUVD-2026-65695
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
NVD 5.5

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Record
CVE-2026-59985
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2026-59985 5.5

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Record
ALPINE-CVE-2026-59985
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2026-59985 5.5
Record
BELL-CVE-2026-59985
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 5.5

OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Record
CVE-2026-59985
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2026-59985 5.5

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Record
DEBIAN-CVE-2026-59985
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-59985 5.5

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Record
UBUNTU-CVE-2026-59985
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:11612-1 No score

libIex-3_4-33-3.4.14-1.1 on GA media

These are all security issues fixed in the libIex-3_4-33-3.4.14-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11612-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12184-1 No score

python313-OpenEXR-3.4.16-1.1 on GA media

These are all security issues fixed in the python313-OpenEXR-3.4.16-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12184-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21737-1 No score

Security update for openexr

This update for openexr fixes the following issues:

  • CVE-2026-59183: unmapped memory access leading to crash due to int32_t multiplication overflow in unpack_sample_table() when decoding a crafted deep tiled EXR file (bsc#1276428).
  • CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero dataWindow.min (bsc#1276849).
  • CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public TiledRgbaInputFile RGBA API (bsc#1276850).
  • CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero dataWindow origin (bsc#1276855).
  • CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero dataWindow origin (bsc#1276862).
  • CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero dataWindow origin (bsc#1276853).
  • CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR (bsc#1276856).
  • CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR (bsc#1276857).
  • CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR (bsc#1276858).
  • CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty multiView header attribute (bsc#1276859).
  • CVE-2026-68515: heap out-of-bounds write in exrmultiview when combining two specially crafted, individually valid scanline EXR files whose union dataWindow is not aligned to one view's channel subsampling (bsc#1276848).
Record
openSUSE-SU-2026:21737-1
Updated
2026-11-02
OSVSUSE-SU-2026:23604-1 No score

Security update for openexr

This update for openexr fixes the following issues:

  • CVE-2026-59183: unmapped memory access leading to crash due to int32_t multiplication overflow in unpack_sample_table() when decoding a crafted deep tiled EXR file (bsc#1276428).
  • CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero dataWindow.min (bsc#1276849).
  • CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public TiledRgbaInputFile RGBA API (bsc#1276850).
  • CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero dataWindow origin (bsc#1276855).
  • CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero dataWindow origin (bsc#1276862).
  • CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero dataWindow origin (bsc#1276853).
  • CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR (bsc#1276856).
  • CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR (bsc#1276857).
  • CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR (bsc#1276858).
  • CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty multiView header attribute (bsc#1276859).
  • CVE-2026-68515: heap out-of-bounds write in exrmultiview when combining two specially crafted, individually valid scanline EXR files whose union dataWindow is not aligned to one view's channel subsampling (bsc#1276848).
Record
SUSE-SU-2026:23604-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openexr
Alpine:v3.24
 before 3.4.15-r0
3.4.15-r0
openexr
Alpaquita:stream
 3.4.4-r0 up to 3.4.15-r0
3.4.15-r0
openexr
Debian:12
 All versions, plus listed versions
3.1.13-13.1.13-23.1.5-53.1.5-5.13.1.5-5.1+hurd.1
Show 6 moreShow less
3.4.14-0.13.4.15+ds-13.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-4
 None known
openexr
Debian:13
 All versions, plus listed versions
3.1.13-23.4.14-0.13.4.15+ds-13.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-4
 None known
openexr
Debian:14
 before 3.4.14-0.1, plus listed versions
3.1.13-23.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-4
3.4.14-0.1
openexr
SUSE:Linux Enterprise Server 16.0
 before 3.2.2-160000.10.1
3.2.2-160000.10.1
openexr
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.2.2-160000.10.1
3.2.2-160000.10.1
openexr
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.2.0-1ubuntu32.2.0-7ubuntu12.2.0-9ubuntu12.2.0-10ubuntu22.2.0-10ubuntu2.1
Show 8 moreShow less
2.2.0-10ubuntu2.22.2.0-10ubuntu2.32.2.0-10ubuntu2.42.2.0-10ubuntu2.62.2.0-10ubuntu2.6+esm12.2.0-10ubuntu2.6+esm22.2.0-10ubuntu2.6+esm32.2.0-10ubuntu2.6+esm4
 None known
openexr
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.0-11ubuntu12.2.0-11.1ubuntu12.2.0-11.1ubuntu1.12.2.0-11.1ubuntu1.22.2.0-11.1ubuntu1.3
Show 6 moreShow less
2.2.0-11.1ubuntu1.42.2.0-11.1ubuntu1.62.2.0-11.1ubuntu1.72.2.0-11.1ubuntu1.82.2.0-11.1ubuntu1.92.2.0-11.1ubuntu1.9+esm1
 None known
openexr
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.2.1-4.1ubuntu12.3.0-62.3.0-6build12.3.0-6ubuntu0.12.3.0-6ubuntu0.2
Show 4 moreShow less
2.3.0-6ubuntu0.32.3.0-6ubuntu0.52.3.0-6ubuntu0.5+esm12.3.0-6ubuntu0.5+esm2
 None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
openexr
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.5.4-22.5.7-12.5.7-1ubuntu0.1~esm12.5.7-1ubuntu0.1~esm2
 None known
openexr
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.1.5-5.13.1.5-5.1build13.1.5-5.1build23.1.5-5.1build33.1.5-5.1ubuntu0.1~esm1
 None known
openexr
Ubuntu:26.10
 All versions, plus listed versions
3.1.13-2build13.4.6+ds-4ubuntu3
 None known
openexr
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.1.13-23.1.13-2build13.1.13-2ubuntu0.26.04.1~esm1
 None known
openexr
openSUSE:Tumbleweed
 before 3.4.14-1.1
3.4.14-1.1
python-OpenEXR
openSUSE:Tumbleweed
 before 3.4.16-1.1
3.4.16-1.1
openexr
openSUSE:Leap 16.0
 before 3.2.2-160000.10.1
3.2.2-160000.10.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-59985 is a medium vulnerability (CVSS 5.5) in Academysoftwarefoundation Openexr, published August 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in openexr 3.4.15-r0.

References

Show 38 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open