Search: CVE-2026-59984

CVE-2026-59984 is an out-of-bounds write vulnerability in the AcademySoftwareFoundation openexr library affecting ILP32 builds. The flaw occurs in versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 when processing crafted B44-compressed scanline EXR images. The vulnerability allows an attacker to cause denial of service or memory corruption by triggering a logical scratch size truncation before allocation, leading to unsafe writes. Fixed versions are 3.2.11, 3.3.13, and 3.4.14. The CVSS score is 5.5 (medium severity).