CVE-2026-59186: CWE-122: Heap-based Buffer Overflow in AcademySoftwareFoundation openexr

OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write on 32-bit/ILP32 builds when processing a specially crafted tiled EXR image via the public TiledRgbaInputFile RGBA API. The crafted file uses a small 40x40 dataWindow but an extremely large 65537x65537 tile size. On ILP32 platforms, the calculation for the Array2D<Rgba> tile-conversion buffer size overflows, resulting in allocation of a smaller heap buffer than needed. The tile decode process then writes past this buffer, causing a heap-based buffer overflow. The issue is resolved in versions 3.2.11, 3.3.13, and 3.4.14.

Successful exploitation can lead to a heap-based buffer overflow on affected 32-bit/ILP32 builds of openexr, potentially causing application crashes or other undefined behavior. The CVSS score of 7.1 indicates a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. There are no known exploits in the wild at this time.

This vulnerability is fixed in openexr versions 3.2.11, 3.3.13, and 3.4.14. Users should upgrade to one of these versions or later to remediate the issue. No other mitigation or temporary workaround is indicated.