CVE-2026-59982: CWE-190: Integer Overflow or Wraparound in AcademySoftwareFoundation openexr

The vulnerability in OpenEXR arises from the combination of zero-based row access with an absolute-coordinate-adjusted base pointer in the TypedDeepImageChannel::row() API. When a crafted deep EXR image has a nonzero dataWindow origin, this can cause an integer overflow or wraparound, resulting in an out-of-bounds pointer being returned. This pointer misuse can cause a crash or limited information disclosure. The flaw affects multiple version ranges: all versions before 3.2.11, versions 3.3.0 through 3.3.12, and versions 3.4.0 through 3.4.13. The vulnerability is addressed in versions 3.2.11, 3.3.13, and 3.4.14.

Exploitation of this vulnerability can cause application crashes (denial of service) or limited information disclosure due to out-of-bounds pointer dereferencing. The CVSS score of 7.1 indicates a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact.

A fix is available in OpenEXR versions 3.2.11, 3.3.13, and 3.4.14. Users and administrators should upgrade affected OpenEXR installations to these versions or later to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.