OpenEXR CVE-2026-59984

Exploitation is strictly limited to ILP32 (32-bit) builds of OpenEXR where size_t and int are both 32-bit wide; 64-bit builds are explicitly not affected regardless of version. The crafted input must be a B44-compressed scanline EXR file with attacker-controlled channel width values in the image header. User interaction is required: the victim must actively open the malicious file using an OpenEXR-consuming application (library, CLI tool, or Python bindings). The CVSS PR:N metric confirms no authentication or special privileges are required of the attacker to create or deliver the file, but the ILP32 build constraint substantially limits the vulnerable population to legacy, embedded, or 32-bit-targeted deployments. Exploitation against automated pipelines or services that ingest untrusted EXR files without user-in-the-loop interaction remains a realistic sub-scenario within the UI:R framing, since 'user interaction' in this context means any actor invoking the decode path.

The CVSS 5.5 rating accurately reflects the constrained exploitation conditions: AV:L requires the crafted file to be present on the local system, and UI:R demands the victim actively open it, ruling out fully unauthenticated remote exploitation against unattended services. The attack surface is further narrowed to ILP32 build configurations specifically, meaning modern 64-bit deployments of OpenEXR - the dominant configuration in enterprise and cloud VFX pipelines - are entirely unaffected. No EPSS data was supplied, no CISA KEV listing exists, and no public exploit code has been reported, all consistent with a low-to-moderate real-world exploitation probability at this time. The primary confirmed impact is denial of service via process crash; however, memory corruption carries a non-trivial theoretical potential for code execution that the CVSS score does not reflect, particularly in scenarios where the OpenEXR library is embedded in a rendering daemon or batch-processing service running on 32-bit embedded or legacy hardware. Any VFX pipeline or automated rendering service that processes untrusted or third-party EXR files on 32-bit infrastructure should treat this as a priority upgrade, while organizations exclusively running 64-bit builds face no direct risk from this specific vulnerability.

An attacker crafts a B44-compressed EXR file with channel width and dimension header fields engineered to cause integer overflow in the ILP32 scratch buffer size calculation, then delivers the file to a victim via email, shared network storage, or a web upload endpoint serving a rendering or conversion pipeline. When the victim or an automated process opens the file with any OpenEXR-consuming application on a 32-bit build, uncompress_b44_impl() writes beyond the allocated buffer, crashing the process and corrupting adjacent heap memory. No public exploit code is known at time of analysis, and successful exploitation beyond denial of service has not been confirmed.