OpenEXR CVE-2026-59187

Exploitation requires three concurrent conditions: (1) the target must invoke the exrmetrics command-line utility - not a passive viewer or renderer - against the supplied file; (2) a pixel conversion flag (--pixelmode float or --bench) must be present in the invocation; and (3) the EXR file must use the deep scanline format. Standard EXR processing via libOpenEXR in rendering or compositing applications is not affected. User interaction (UI:R) is required - an operator or automated script must actively execute exrmetrics on the crafted file. Exploitation is limited to contexts where exrmetrics is used in automated ingest pipelines accepting external EXR input with conversion options enabled.

The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) reflects a network-deliverable, low-complexity attack gated only by user interaction. The primary documented impact is high availability loss (process crash); C:N and I:L suggest limited assessed exploit reliability for code execution, though heap overwrite primitives carry inherent RCE potential beyond what the CVSS conservatively scores. EPSS data is not provided in the source intelligence, so probability-of-exploitation cannot be quantified against the base rate. No CISA KEV listing and no public POC confirm this is not currently a commodity-exploited vulnerability. Real-world risk is moderated by the specific invocation path required: exrmetrics must be run explicitly with conversion flags against untrusted input, which is unusual for production rendering pipelines. The highest practical risk sits in automated VFX ingest pipelines that invoke exrmetrics with --pixelmode or --bench on externally supplied assets.

An attacker crafts a malicious deep scanline EXR file and delivers it to a VFX pipeline or individual operator that runs exrmetrics with --pixelmode float or --bench for benchmarking purposes. When exrmetrics processes the file, the HALF-to-FLOAT size mismatch causes a write past the end of the heap-allocated sample buffer, crashing the process or, under favorable heap layout conditions, enabling arbitrary code execution in the context of the invoking user. No public proof-of-concept has been identified at time of analysis.