Vulnerability details

CVE-2026-59187

AcademySoftwareFoundation openexr

OpenEXR: exrmetrics deep pixelmode heap buffer overflow

CVSS 3.1

7.1High

Official description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

CVSS scores

Score	Version	Source	Vector
7.1High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H`

Affected products

Vendor	Product	Versions	Source
AcademySoftwareFoundation	openexr	>= 3.3.0, < 3.3.13	CVEProject cvelistV5 (CNA)
AcademySoftwareFoundation	openexr	>= 3.4.0, < 3.4.14	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-6jj8-cxcr-j8hm x_refsource_CONFIRM
https://github.com/AcademySoftwareFoundation/openexr/commit/46e70220dc91dbc1341fac4671704e970b450585 x_refsource_MISC
https://github.com/AcademySoftwareFoundation/openexr/commit/7e772dd704b9b5d6dc2564647d89f7813f608e94 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-08-25
Last updated: 2026-08-25
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.4%

Probability of exploitation in 30 days

34.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-122
Heap-based Buffer Overflow
CWE-787
Out-of-bounds Write