CVE-2026-59981 AcademySoftwareFoundation CVE debrief

Who should care

Defenders responsible for systems that use OpenEXR, such as motion picture industry applications, should assess exposure and prioritize updates to fixed versions. This includes operators, platform administrators, vulnerability management teams, and security teams that oversee OpenEXR deployments. They should verify proper handling of deep images with non-zero dataWindow origins and monitor for potential crashes or unexpected behavior when processing EXR

Why it matters

CVE-2026-59981 is a vulnerability in OpenEXR that can lead to out-of-bounds reads and potential process crashes or exposure of heap memory. Defenders should prioritize updates and verify proper handling of deep images.

• Potential process crashes when processing malicious EXR files
• Potential exposure of adjacent heap memory as sample-count values
• Need for verification of OpenEXR version and proper handling of deep images
• Priority for updating OpenEXR to fixed versions

Technical summary

The OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::row() API when a deep image has a non-zero dataWindow origin. This can lead to an out-of-bounds read, potentially crashing the process or returning adjacent heap memory as sample-count values. The vulnerability occurs when a deep image has a non-zero dataWindow origin, causing a conflict between the 0-based row() accessor and the internal base offset for absolute pixel coordinates. An application that opens an attacker-controlled deep EXR file and accesses sample counts through row() performs an out-of-bounds read. Defenders should prioritize updating OpenEXR to a fixed version and verify that applications using OpenEXR are

Defensive priority

Defenders should prioritize updating OpenEXR to a fixed version, such as 3.2.11, 3.3.13, or 3.4.14, and verify that applications using OpenEXR are properly handling deep images with non-zero dataWindow origins.

Recommended defensive actions

• Update OpenEXR to version 3.2.11, 3.3.13, or 3.4.14
• Verify that applications using OpenEXR properly handle deep images with non-zero dataWindow origins
• Monitor for potential crashes or unexpected behavior when processing EXR files
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a conflict between the 0-based row() accessor and the internal base offset for absolute pixel coordinates when dataWindow.min is non-zero. This issue can be triggered by opening an attacker-controlled deep EXR file and accessing sample counts through row().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.