High severity7.1NVD Advisory· Published Aug 25, 2026· Updated Sep 9, 2026
CVE-2026-59982
CVE-2026-59982
Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: <3.2.11, 3.3.0-3.3.12, 3.4.0-3.4.13
- osv-coords2 versionspkg:rpm/opensuse/openexr&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/openexr&distro=openSUSE%20Tumbleweed
< 3.2.2-160000.10.1+ 1 more
- (no CPE)range: < 3.2.2-160000.10.1
- (no CPE)range: < 3.4.14-1.1
Patches
Vulnerability mechanics
References
4- github.com/AcademySoftwareFoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1nvd
- github.com/AcademySoftwareFoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77cnvd
- github.com/AcademySoftwareFoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089decnvd
- github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-6662-fq6f-93mpnvd
News mentions
1- OpenEXR: 22 Memory Corruption Vulnerabilities Disclosed in Batch, Patched in 3.2.11/3.3.13/3.4.14Vypr Intelligence · Aug 25, 2026