OpenEXR CVE-2026-59186

The vulnerability is exclusively triggered on 32-bit/ILP32 builds of OpenEXR where sizeof(int) sizeof(long) 4; 64-bit builds (the vast majority of modern deployments) are not affected because size_t arithmetic at 64 bits does not overflow for the tile dimensions used in the attack. The vulnerable code path is reached through the public TiledRgbaInputFile RGBA API when decoding a tiled EXR file - applications that use only the scanline API are not exposed through this specific path. CVSS UI:R confirms that a user or pipeline process must actively open or ingest the crafted file; the vulnerability cannot be triggered by passive network exposure without file processing. CVSS PR:N confirms no authentication or privilege is required from the attacker - the malicious file itself is the complete attack vehicle. Exploitation is limited to environments processing untrusted or externally-sourced EXR files on legacy 32-bit infrastructure.

The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) correctly captures network delivery and low complexity, but the UI:R modifier is critical - exploitation requires a user or automated pipeline process to actively open the crafted file. More importantly, the vulnerability is architecturally gated to 32-bit/ILP32 builds; on 64-bit targets the size_t arithmetic does not overflow and the code path is safe, substantially narrowing the realistic attack surface. No EPSS score was provided in the source intelligence, and the vulnerability carries no CISA KEV listing, meaning no confirmed active exploitation is known. No public POC has been identified. The combination of a build-environment prerequisite, required user interaction, and absence of known exploitation places this in a 'patch on schedule' priority tier for most organizations; deployments that run OpenEXR on legacy 32-bit infrastructure in media ingest pipelines processing untrusted files should treat it as higher urgency. The high Availability impact (A:H) reflects reliable crash potential; the low Integrity impact (I:L) reflects limited heap write control under typical exploitation, and Confidentiality is not impacted because the flaw is a write-side overflow with no read primitive.

An attacker crafts a malicious EXR file embedding a 65537×65537 tile size in the file header alongside a small 40×40 dataWindow, then delivers it to a victim through a shared file system, email attachment, or web upload. When a VFX artist or automated media ingest process opens the file in an application linked against a 32-bit OpenEXR build, Array2D computes the corrupted buffer size, allocates an undersized heap region, and the tile decoder overflows it, reliably crashing the application and potentially enabling heap layout manipulation for further exploitation.