CVE-2026-59187 AcademySoftwareFoundation CVE debrief

Who should care

Defenders responsible for systems processing EXR images, especially in the motion picture industry or other environments using OpenEXR, should assess exposure and prioritize patching.

Why it matters

CVE-2026-59187 is a heap out-of-bounds write vulnerability in OpenEXR that can lead to data corruption or crashes when processing crafted EXR images. Defenders in the motion picture industry or other environments using OpenEXR should assess exposure, prioritize patching to versions 3.3.13 or 3.4.14, and restrict processing of EXR images from untrusted sources.

• Potential for data corruption or crashes when processing malicious EXR images
• Need for verification of OpenEXR version and exposure to crafted EXR images
• Priority for patching vulnerable OpenEXR installations
• Potential for denial-of-service or instability in affected systems

Technical summary

The vulnerability occurs when exrmetrics reads a crafted deep scanline EXR image with pixel conversion options such as --pixelmode float or --bench, triggering a heap out-of-bounds write due to DeepSlice requesting FLOAT output while the backing sample buffers are allocated using the input HALF element size. This issue can lead to data corruption or crashes when processing crafted EXR images. Defenders should prioritize patching vulnerable OpenEXR installations, especially in environments processing EXR images from untrusted sources.

Defensive priority

Defenders should prioritize patching vulnerable OpenEXR installations, especially in environments processing EXR images from untrusted sources.

Recommended defensive actions

• Patch OpenEXR installations to version 3.3.13 or 3.4.14
• Restrict processing of EXR images from untrusted sources
• Monitor for suspicious EXR image processing activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13. Fixes are available in versions 3.3.13 and 3.4.14. The issue was identified through analysis of the OpenEXR codebase and verification of the patch in versions 3.3.13 and 3.4.14. Defenders should verify OpenEXR version and exposure to crafted EXR images.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.