OpenEXR CVE-2026-59183

The target application must decode deep tiled EXR files - a specific sub-format identified by the DEEPTILE tile description type in the EXR header, used for volumetric compositing data. Flat tiled and scanline EXR variants are NOT affected. CVSS UI:R means a user or automated process must actively invoke decoding of the crafted file; passive exposure (e.g., thumbnail preview without full decode) does not trigger the vulnerable path. CVSS PR:N confirms no authentication or privileged account is required on the affected system. Limiting factors: exploitation is constrained to environments that process deep tiled EXR specifically (common in high-end VFX, uncommon in general image tooling); crash-only impact with no memory disclosure or code execution means the exploit cannot be leveraged for privilege escalation or data theft based on current evidence.

CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately reflects a file-parsing DoS with no code execution and no privilege escalation. The AV:L/UI:R combination places this squarely in 'malicious file opened by a local user' territory. No EPSS score was provided, but the absence of KEV listing, the specialized format requirement (deep tiled EXR), and the pure crash impact all point to low real-world exploitation priority for most organizations. However, in VFX pipeline environments where EXR files are ingested automatically from untrusted sources (client submissions, render farm inputs, asset exchange), the AV:L framing may understate risk - a server-side EXR processing service effectively presents a network attack surface. In those deployment contexts, this deserves higher priority than the CVSS score suggests. CAVEAT: The CVSS vector is assigned by GitHub Security (security-advisories@github.com), not independently verified by NVD at time of analysis.

An attacker crafts a deep tiled EXR file containing chunk width/height values calculated to make their int32_t product wrap to a small or negative number, then delivers it to a target (e.g., via email attachment, asset submission portal, or render job input). When a VFX artist or automated pipeline tool opens the file using an affected OpenEXR build, the overflowed pointer in unpack_sample_table() causes a read from an unmapped address and immediately crashes the host application. No public proof-of-concept code has been published, but the fix commits publicly disclose the exact overflow location, lowering the barrier to reproducing the crash.