CVE-2026-59982 AcademySoftwareFoundation CVE debrief

Who should care

Defenders responsible for systems and applications using OpenEXR should assess exposure and prioritize updates to prevent potential crashes or information disclosure. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update affected systems and applications.

Why it matters

CVE-2026-59982 is a vulnerability in OpenEXR that can cause system crashes or limited information disclosure. Defenders should prioritize updates to prevent these consequences.

• Potential system crashes due to out-of-bounds pointer returns
• Limited information disclosure from crafted deep EXR images

Technical summary

OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. The issue has been fixed in OpenEXR versions 3.2.11, 3.3.13, and 3.4.14, and defenders should prioritize updating OpenEXR to a fixed version.

Defensive priority

Defenders should prioritize updating OpenEXR to a fixed version to prevent potential crashes or information disclosure.

Recommended defensive actions

• Update OpenEXR to version 3.2.11, 3.3.13, or 3.4.14
• Review and update affected systems and applications
• Monitor for potential crashes or information disclosure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. The vulnerability has been fixed in OpenEXR versions 3.2.11, 3.3.13, and 3.4.14. Defenders should verify affected scope, severity, and vendor guidance. The CVE record was published on 2026-08-25T18:17:56.747Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.