OpenEXRUtil CVE-2026-59189

Exploitation requires that the target application uses the TypedDeepImageChannel<T>::row(), FlatImageChannel::row(), or SampleCountChannel::row() API from the OpenEXRUtil library (not the lower-level core OpenEXR library) and processes an EXR image whose dataWindow.min has at least one non-zero coordinate - a valid but non-default EXR configuration. A victim user or automated process must open or ingest the crafted file (CVSS UI:R). Information disclosure beyond crash additionally requires the attacker to control heap layout through prior allocations, which is a non-trivial capability. Exploitation is limited to software explicitly linking against OpenEXRUtil and invoking the row() accessor on deep or flat image channels; applications using only at(x, y) or direct core-library access are unaffected.

The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) reflects a reliably triggerable crash with low-complexity exploitation, requiring no attacker privileges but demanding that a victim open or process a crafted file. The primary practical risk is denial-of-service in any application pipeline that ingests untrusted EXR files - image editors, compositing tools, asset ingest services. The confidentiality impact (C:L) is plausible but explicitly contingent on a controlled heap layout, making information disclosure a secondary and less-certain outcome. No EPSS data was provided, so exploitation probability cannot be quantified; no KEV listing and no public exploit code exist at time of analysis, indicating this is not currently subject to widespread opportunistic exploitation. Real-world exposure is bounded by OpenEXRUtil's deployment footprint, which is concentrated in media/VFX production environments rather than broadly deployed internet-facing infrastructure. The risk is genuine for organizations running automated EXR ingestion pipelines against untrusted inputs but is lower-priority for most enterprise environments.

An attacker crafts a malformed EXR file with a non-zero dataWindow.min (e.g., origin at (1024, -1024)) and delivers it to a victim via a file upload endpoint, email attachment, or shared asset repository targeting a VFX or media production pipeline using affected OpenEXRUtil versions. When the application opens the file and calls row() on a deep or flat image channel, the function dereferences a heap address before the allocation boundary, crashing the application; if the attacker can pre-shape the heap via earlier requests or allocations, limited heap contents adjacent to the allocation may also be readable.