CVE-2026-59184: CWE-416: Use After Free in AcademySoftwareFoundation openexr

The openexr library, used for handling EXR image files, contains a use-after-free vulnerability (CWE-416) combined with out-of-bounds write conditions (CWE-787) in certain versions. Specifically, when processing a crafted EXR file with a nonzero dataWindow.min, the TypedFlatImageChannel::row() function may return an invalid heap pointer. This leads to memory corruption when rows are written through FlatHalfChannel::row(). This vulnerability affects applications that load and write EXR images, particularly those accepting untrusted inputs. The vulnerability is present in versions prior to 3.2.11, from 3.3.0 up to 3.3.12, and from 3.4.0 up to 3.4.13. The issue is resolved in versions 3.2.11, 3.3.13, and 3.4.14.

Successful exploitation can cause out-of-bounds or use-after-free writes, potentially leading to application crashes or denial of service. The CVSS score of 7.1 indicates high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. There is no indication of confidentiality loss or remote code execution from the provided data.

A fix is available in openexr versions 3.2.11, 3.3.13, and 3.4.14. Users and organizations should upgrade to these versions or later to remediate this vulnerability. No other mitigation guidance is provided or required based on the vendor data.