PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59983 AcademySoftwareFoundation CVE debrief

CVE-2026-59983 is a vulnerability in OpenEXR, a reference implementation and specification for the EXR image format widely used in the motion picture industry. A crafted uncompressed deep-tile EXR can cause an out-of-bounds read, leading to denial of service on ILP32 builds. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14. The vulnerability is caused by an out-of-bounds read when decoding a crafted uncompressed deep-tile EXR image, which can lead to denial of service. Defenders responsible for systems that process EXR images should assess exposure and prioritize patching or mitigating this vulnerability.

Vendor
AcademySoftwareFoundation
Product
openexr
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-25
Original CVE updated
2026-09-09
Advisory published
2026-08-25
Advisory updated
2026-09-09

Who should care

Defenders responsible for systems that process EXR images, especially in the motion picture industry, should assess exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-59983 is a vulnerability in OpenEXR that can cause denial of service on ILP32 builds. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where EXR images are processed.

  • Denial of service through crafted EXR image processing
  • Potential for system crashes or instability

Technical summary

OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to an out-of-bounds read on ILP32 builds. A crafted uncompressed deep-tile EXR can cause the sample-count table size calculation in OpenEXRCore decoding.c to wrap before unpack_sample_table() iterates over the full attacker-controlled tile dimensions, allowing denial of service. The issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where EXR images are processed.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where EXR images are processed.

Recommended defensive actions

  • Patch OpenEXR to version 3.2.11, 3.3.13, or 3.4.14
  • Restrict access to EXR image processing to trusted sources
  • Monitor for suspicious EXR image processing activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by an out-of-bounds read when decoding a crafted uncompressed deep-tile EXR image. This can lead to denial of service. The issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-59983 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-59983

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-59983 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-59983

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.