OpenEXR CVE-2026-59184

Exploitation requires all of the following: (1) the target application links against an affected OpenEXR version (before 3.2.11, 3.3.0-3.3.12, or 3.4.0-3.4.13); (2) the application uses the OpenEXRUtil library and specifically invokes the TypedFlatImageChannel::row() or FlatHalfChannel::row() code path when writing pixel rows - applications that read EXR files without using this particular API are not vulnerable; (3) the application processes EXR files sourced from an attacker-controlled or untrusted input (the crafted file must have a nonzero dataWindow.min, which is a legitimate value per the EXR specification and passes normal format validation); and (4) a user or automated pipeline component must trigger the processing of the crafted file (CVSS UI:R). Applications operating exclusively on internally-generated EXR files with origin-aligned data windows (dataWindow.min = 0,0) are not at risk. Authentication requirements are not confirmed beyond the CVSS PR:N rating, which indicates no privileges are needed to submit the file to a processing service.

The CVSS 3.1 score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H accurately characterizes a network-reachable vulnerability requiring no privileges but demanding that a user or automated pipeline component process the crafted file. The UI:R requirement meaningfully reduces exposure compared to fully autonomous exploitation - only pipeline components or applications that actively ingest external EXR files are reachable. The high availability impact (A:H) reflects a likely process crash from the memory corruption, while the low integrity rating (I:L) reflects that uncontrolled heap writes may corrupt limited data without confirmed code execution. EPSS data was not provided, so quantitative exploitation probability cannot be stated. The vulnerability is absent from CISA KEV and no public proof-of-concept has been identified, which substantially lowers operational urgency relative to the raw CVSS score. Real-world exposure is concentrated in VFX render farms, compositing tools, and image-processing microservices that accept externally-sourced EXR files; internal production pipelines operating exclusively on trusted, internally-generated EXR assets face negligible risk. The memory write primitive (out-of-bounds/use-after-free) is theoretically escalatable to code execution with sufficient exploit development effort, but no evidence of such capability exists in the available intelligence.

An attacker uploads or delivers a crafted EXR image file containing a nonzero dataWindow.min value to a rendering service, compositing tool, or image-conversion API that uses OpenEXR. When the service processes the file and calls FlatHalfChannel::row() to write pixel data, the miscalculated '_base' pointer causes writes to an invalid heap location, crashing the process and causing denial of service. No public proof-of-concept exploit has been identified at the time of analysis, but the memory write primitive could theoretically be developed further into a code execution capability.