CVE-2026-59187: CWE-122: Heap-based Buffer Overflow in AcademySoftwareFoundation openexr

The vulnerability in OpenEXR (CVE-2026-59187) is a heap-based buffer overflow occurring in versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13. It happens when the exrmetrics tool reads a specially crafted deep scanline EXR file with pixel conversion options like --pixelmode float or --bench. The root cause is that DeepSlice requests FLOAT output while the sample buffers are allocated based on the input HALF element size, causing a heap out-of-bounds write. This can lead to denial of service or other impacts related to memory corruption. The issue is resolved in versions 3.3.13 and 3.4.14.

The heap-based buffer overflow can cause application crashes or potentially enable limited code execution or memory corruption. The CVSS score of 7.1 (high) reflects the network attack vector with low attack complexity and no privileges required, but user interaction is needed. The impact is primarily availability (denial of service) and integrity loss, with no confidentiality impact noted.

Users should upgrade OpenEXR to versions 3.3.13 or later, or 3.4.14 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.