CVE-2026-59981: CWE-125: Out-of-bounds Read in AcademySoftwareFoundation openexr

OpenEXR, a widely used image file format library, contains a vulnerability in the SampleCountChannel::row() API where the coordinate models conflict if the deep image's dataWindow origin is non-zero. Specifically, for deep images with a large negative vertical origin, row(0) returns a pointer outside the allocated sample-count buffer, leading to an out-of-bounds read. This can cause application crashes or, under certain heap conditions, expose adjacent heap memory as sample-count values. The vulnerability affects versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 and is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

An attacker can craft a malicious deep EXR file that triggers an out-of-bounds read when processed by vulnerable versions of OpenEXR. This can lead to application crashes (denial of service) or, in specific heap layouts, disclosure of adjacent heap memory contents. There is no indication of integrity or privilege impact. The CVSS score is 7.1 (high), reflecting network attack vector, low complexity, no privileges required, user interaction required, and impact on confidentiality and availability.

Fixed versions 3.2.11, 3.3.13, and 3.4.14 address this vulnerability. Users should upgrade to these or later versions to remediate the issue. No vendor advisory is provided here, but the fix status is clear from the description. Until upgraded, avoid processing untrusted deep EXR files with vulnerable versions.