CVE-2026-59189: CWE-125: Out-of-bounds Read in AcademySoftwareFoundation openexr

OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12 contain an out-of-bounds read vulnerability in the TypedDeepImageChannel<T>::row() API. The root cause is the use of two conflicting coordinate models: the at(x, y) method uses absolute coordinates offset by dataWindow.min, while row(r) uses 0-based logical access. When dataWindow.min is non-zero, row(0) returns a pointer outside the _sampleListPointers allocation, causing a heap out-of-bounds read. This can lead to application crashes and potential information disclosure if the heap layout is controlled. The vulnerability is tracked as CWE-125 and has a CVSS 3.1 score of 7.1 (high severity). It is fixed in OpenEXRUtil versions 3.3.13 and 3.4.13.

The vulnerability allows an attacker to cause a heap out-of-bounds read, which can crash the application using the vulnerable OpenEXR library. Under controlled heap conditions, it may also lead to information disclosure. There is no indication of integrity or availability impact beyond the crash. No known exploits in the wild have been reported.

This vulnerability is fixed in OpenEXRUtil versions 3.3.13 and 3.4.13. Users should upgrade to these versions or later to remediate the issue. No other mitigation or workaround is documented. Patch status is not explicitly confirmed in the vendor advisory, but the fix versions are clearly stated.