In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the… (CVE-2026-59981)

The OpenEXRUtil library in OpenEXR versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 has a flaw in the SampleCountChannel::row() API. When handling deep images with a non-zero dataWindow origin, the row() accessor, which is 0-based, conflicts with the internal base offset for absolute pixel coordinates. This results in row(0) pointing outside the allocated sample-count buffer for images with a large negative vertical origin. An application opening a crafted deep EXR file and accessing sample counts via row() may perform an out-of-bounds read, causing crashes or leaking adjacent heap memory as sample-count values. The vulnerability is addressed in OpenEXR versions 3.2.11, 3.3.13, and 3.4.14.

Exploitation of this vulnerability can cause application crashes due to out-of-bounds reads. Under certain controlled heap layouts, it may also lead to disclosure of adjacent heap memory contents as sample-count values. There is no indication of privilege escalation or code execution. The CVSS v3.1 score is 7.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

This vulnerability is fixed in OpenEXR versions 3.2.11, 3.3.13, and 3.4.14. Users and administrators should upgrade to these or later versions to remediate the issue. No other mitigation or workaround is indicated by the vendor advisory.