Academysoftwarefoundation

CVE	Summary	Severity	CVSS	EPSS	Priority
CVE-2026-59982	Out-of-bounds pointer arithmetic in OpenEXR's TypedDeepImageChannel::row() - and parallel methods in FlatImageChannel and SampleCountChannel - affects all releases before 3.2.11, 3.3.13, and 3.4.14, exposing applications that process deep EXR files with nonzero dataWindow origins to deterministic crash or limited heap memory disclosure. The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R) reflects unauthenticated, low-complexity delivery of a crafted image file requiring only that a user or pipeline opens it, with high availability impact and limited confidentiality exposure. No CISA KEV listing and no public exploit code have been identified at time of analysis; patched releases are available from the Academy Software Foundation.	HIGH	7.1	0.3%	36
CVE-2026-53532	Process-aborting denial of service in OpenEXR 3.4.0 through 3.4.12 allows an unauthenticated remote attacker to crash any application that calls exr_start_read() on a crafted HTJ2K-compressed EXR file. The crash originates in the vendored OpenJPH library, which invokes abort() unconditionally when a QCD marker's lower five bits are zero - an assertion failure that OpenEXR's partial error handling cannot intercept because codestream read and construction calls are left unprotected. No public exploit has been identified at time of analysis; the vulnerability is patched in version 3.4.13.	HIGH	7.1	0.3%	36
CVE-2026-59189	Heap out-of-bounds read in OpenEXRUtil's deep and flat image channel row() API allows an attacker supplying a crafted EXR file with a non-zero dataWindow origin to crash any application that processes the file, with conditional heap memory disclosure dependent on attacker-controlled heap layout. Affected are OpenEXRUtil versions 3.3.0-3.3.12 and 3.4.0-3.4.12; the flaw exists across three channel header implementations (ImfDeepImageChannel.h, ImfFlatImageChannel.h, ImfSampleCountChannel.h). No public exploit identified at time of analysis, and patched releases 3.3.13 and 3.4.13 are available.	HIGH	7.1	0.2%	36
CVE-2026-59186	Heap out-of-bounds write in OpenEXR's TiledRgbaInputFile RGBA API affects all three active release lines on 32-bit/ILP32 builds, allowing a remote attacker to deliver a crafted EXR file that crashes or corrupts the heap of any application that opens it. The root cause is a 32-bit integer overflow in the Array2D<Rgba> buffer size calculation when tile dimensions (65537×65537) are encoded in the file header but the actual dataWindow is tiny (40×40), causing the allocator to produce an undersized buffer that tile decode then overflows. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-released patches are available across all three affected release branches.	HIGH	7.1	0.2%	36
CVE-2026-59184	Out-of-bounds and use-after-free memory writes in OpenEXR's FlatImageChannel row() API expose rendering pipelines and image-processing services to denial-of-service and potential memory corruption when handling untrusted EXR files. Affected versions include all releases before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13; the flaw is triggered specifically when an application calls FlatHalfChannel::row() on an EXR image with a nonzero dataWindow.min value. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis.	HIGH	7.1	0.2%	36
CVE-2026-59187	Heap out-of-bounds write in OpenEXR 3.3.0-3.3.12 and 3.4.0-3.4.13 allows an attacker who can supply a crafted deep scanline EXR file to crash the exrmetrics utility or potentially execute arbitrary code when pixel conversion options are active. The flaw arises from a HALF/FLOAT element-size mismatch: sample buffers are allocated for 2-byte HALF input while DeepSlice writes 4-byte FLOAT output, overrunning the heap. No public exploit or active exploitation has been identified at time of analysis; fixed releases 3.3.13 and 3.4.14 are available.	HIGH	7.1	0.2%	36
CVE-2026-68513	Heap buffer overflow in PyOpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 allows an attacker to corrupt process memory by supplying a crafted EXR image file containing conflicting literal and prefixed RGB channel names. When the Python wrapper decodes such a file under the default separate_channels=False mode, a channel-name key collision causes the coalescing logic to reuse an undersized NumPy array and write pixel data out of bounds on the heap, producing high integrity and availability impact with no confidentiality exposure. No public exploit code has been identified and no active exploitation is confirmed; patched releases 3.3.13 and 3.4.14 are available from the Academy Software Foundation.	HIGH	7.1	0.2%	36
CVE-2026-68515	Heap out-of-bounds write in OpenEXR's exrmultiview utility allows an attacker who can supply crafted EXR files to corrupt heap memory when the tool combines two individually valid scanline EXR files whose union dataWindow is misaligned to one view's channel subsampling. Affected are OpenEXR versions across three maintained branches (pre-3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13), all fixed in their respective patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, though the attack is achievable via normal command-line invocation with attacker-supplied files in VFX pipeline contexts.	HIGH	7.1	0.1%	36
CVE-2026-55371	NULL pointer dereference in OpenEXR 3.4.0-3.4.12 causes a deterministic crash in the OpenEXRCore C API function `exr_attr_set_bytes()` when a caller passes a positive `hint_length` alongside a NULL `type_hint` pointer, enabling reliable denial of service against any application that processes EXR content via this API. The flaw is confined to availability impact with no confidentiality or integrity exposure, and the CVSS 4.0 local attack vector limits remote exploitation to indirect paths such as network-facing EXR parsing pipelines. No public exploit code or active exploitation has been identified; a vendor-released patch is available in version 3.4.13.	MEDIUM	6.9	0.1%	35
CVE-2026-55373	Infinite-loop denial of service in OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 allows an attacker to permanently hang any process that parses a crafted EXR image by triggering an integer overflow in the sample-count helper roundListSizeUp(). When UINT_MAX is passed as a sample-count value, 32-bit unsigned left-shift arithmetic wraps the accumulator to zero, producing a loop condition that never terminates. The vulnerability is reachable through public OpenEXRUtil APIs, making it exploitable wherever applications accept externally-supplied EXR files. No public exploit code or CISA KEV listing has been identified at time of analysis.	MEDIUM	6.2	0.1%	31
CVE-2026-55059	Heap out-of-bounds write in OpenEXR's DeepImage API affects all versions prior to 3.2.10, 3.3.12, and 3.4.13, exploitable by processing a crafted deep image EXR file. A coordinate axis confusion bug in `Imf_4_0::SampleCountChannel::set()` uses `dataWindow.min.x` instead of `dataWindow.min.y` when computing a target Y coordinate, causing memory writes before the allocated `_numSamples` heap buffer when `min.x ≠ min.y`. No public exploit identified at time of analysis; SUSE Linux Enterprise distributions have received vendor-released patches confirming active remediation.	MEDIUM	6.1	0.1%	31
CVE-2026-68514	Heap buffer overflow in PyOpenEXR Python bindings versions 3.3.0-3.3.12 and 3.4.0-3.4.13 causes memory corruption and process crash when opening a crafted deep scanline EXR file. A specific channel naming collision - a literal channel 'left' coexisting with layer-prefixed 'left.R', 'left.G', 'left.B' - causes the wrapper to allocate scalar-shaped deep sample storage and then write into it at RGB stride (three lanes), overflowing the heap allocation. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 3.3.13 and 3.4.14.	MEDIUM	5.5	0.2%	28
CVE-2026-59983	Out-of-bounds read in OpenEXR's ILP32 builds enables denial of service via crafted uncompressed deep-tile EXR files across three active release branches (before 3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13). The root cause is a 32-bit integer overflow in OpenEXRCore's sample-count table size calculation that causes unpack_sample_table() to iterate beyond an undersized allocation. No public exploit or active exploitation has been identified; vendor-released patches are available for all three affected branches.	MEDIUM	5.5	0.2%	28
CVE-2026-59984	Out-of-bounds write in OpenEXR's B44 decompression path on ILP32 (32-bit) builds allows an attacker to corrupt heap memory and crash any application that opens a crafted EXR file, affecting the C++ libraries, CLI tools, and PyOpenEXR bindings across versions 3.1.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. When a malformed B44-compressed scanline image triggers integer truncation in the scratch buffer size calculation before allocation, uncompress_b44_impl() subsequently writes using the full attacker-controlled channel width into the undersized buffer, producing a heap out-of-bounds write. Patches are confirmed available in 3.2.11, 3.3.13, and 3.4.14; no public exploit is identified at time of analysis.	MEDIUM	5.5	0.2%	28
CVE-2026-59985	Heap out-of-bounds read in OpenEXR's RLE decompression path crashes the decoding process on ILP32 (32-bit) builds across versions 3.2.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. A crafted .exr file with a malicious RLE-compressed payload causes the 64-bit unpacked size to truncate before buffer allocation in OpenEXRCore decoding.c, after which unpack_32bit() reads past the allocated buffer boundary, resulting in denial of service. Exploitation requires a victim or automated pipeline to open the malicious file; no public exploit identified at time of analysis, and the vulnerability is constrained to ILP32 build environments.	MEDIUM	5.5	0.2%	28

CVE-2026-59982

Out-of-bounds pointer arithmetic in OpenEXR's TypedDeepImageChannel::row() - and parallel methods in FlatImageChannel and SampleCountChannel - affects all releases before 3.2.11, 3.3.13, and 3.4.14, exposing applications that process deep EXR files with nonzero dataWindow origins to deterministic crash or limited heap memory disclosure. The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R) reflects unauthenticated, low-complexity delivery of a crafted image file requiring only that a user or pipeline opens it, with high availability impact and limited confidentiality exposure. No CISA KEV listing and no public exploit code have been identified at time of analysis; patched releases are available from the Academy Software Foundation.

HIGH

7.1

0.3%

36

CVE-2026-53532

Process-aborting denial of service in OpenEXR 3.4.0 through 3.4.12 allows an unauthenticated remote attacker to crash any application that calls exr_start_read() on a crafted HTJ2K-compressed EXR file. The crash originates in the vendored OpenJPH library, which invokes abort() unconditionally when a QCD marker's lower five bits are zero - an assertion failure that OpenEXR's partial error handling cannot intercept because codestream read and construction calls are left unprotected. No public exploit has been identified at time of analysis; the vulnerability is patched in version 3.4.13.

HIGH

7.1

0.3%

36

CVE-2026-59189

Heap out-of-bounds read in OpenEXRUtil's deep and flat image channel row() API allows an attacker supplying a crafted EXR file with a non-zero dataWindow origin to crash any application that processes the file, with conditional heap memory disclosure dependent on attacker-controlled heap layout. Affected are OpenEXRUtil versions 3.3.0-3.3.12 and 3.4.0-3.4.12; the flaw exists across three channel header implementations (ImfDeepImageChannel.h, ImfFlatImageChannel.h, ImfSampleCountChannel.h). No public exploit identified at time of analysis, and patched releases 3.3.13 and 3.4.13 are available.

HIGH

7.1

0.2%

36

CVE-2026-59186

Heap out-of-bounds write in OpenEXR's TiledRgbaInputFile RGBA API affects all three active release lines on 32-bit/ILP32 builds, allowing a remote attacker to deliver a crafted EXR file that crashes or corrupts the heap of any application that opens it. The root cause is a 32-bit integer overflow in the Array2D<Rgba> buffer size calculation when tile dimensions (65537×65537) are encoded in the file header but the actual dataWindow is tiny (40×40), causing the allocator to produce an undersized buffer that tile decode then overflows. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-released patches are available across all three affected release branches.

HIGH

7.1

0.2%

36

CVE-2026-59184

Out-of-bounds and use-after-free memory writes in OpenEXR's FlatImageChannel row() API expose rendering pipelines and image-processing services to denial-of-service and potential memory corruption when handling untrusted EXR files. Affected versions include all releases before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13; the flaw is triggered specifically when an application calls FlatHalfChannel::row() on an EXR image with a nonzero dataWindow.min value. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis.

HIGH

7.1

0.2%

36

CVE-2026-59187

Heap out-of-bounds write in OpenEXR 3.3.0-3.3.12 and 3.4.0-3.4.13 allows an attacker who can supply a crafted deep scanline EXR file to crash the exrmetrics utility or potentially execute arbitrary code when pixel conversion options are active. The flaw arises from a HALF/FLOAT element-size mismatch: sample buffers are allocated for 2-byte HALF input while DeepSlice writes 4-byte FLOAT output, overrunning the heap. No public exploit or active exploitation has been identified at time of analysis; fixed releases 3.3.13 and 3.4.14 are available.

HIGH

7.1

0.2%

36

CVE-2026-68513

Heap buffer overflow in PyOpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 allows an attacker to corrupt process memory by supplying a crafted EXR image file containing conflicting literal and prefixed RGB channel names. When the Python wrapper decodes such a file under the default separate_channels=False mode, a channel-name key collision causes the coalescing logic to reuse an undersized NumPy array and write pixel data out of bounds on the heap, producing high integrity and availability impact with no confidentiality exposure. No public exploit code has been identified and no active exploitation is confirmed; patched releases 3.3.13 and 3.4.14 are available from the Academy Software Foundation.

HIGH

7.1

0.2%

36

CVE-2026-68515

Heap out-of-bounds write in OpenEXR's exrmultiview utility allows an attacker who can supply crafted EXR files to corrupt heap memory when the tool combines two individually valid scanline EXR files whose union dataWindow is misaligned to one view's channel subsampling. Affected are OpenEXR versions across three maintained branches (pre-3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13), all fixed in their respective patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, though the attack is achievable via normal command-line invocation with attacker-supplied files in VFX pipeline contexts.

HIGH

7.1

0.1%

36

CVE-2026-55371

NULL pointer dereference in OpenEXR 3.4.0-3.4.12 causes a deterministic crash in the OpenEXRCore C API function `exr_attr_set_bytes()` when a caller passes a positive `hint_length` alongside a NULL `type_hint` pointer, enabling reliable denial of service against any application that processes EXR content via this API. The flaw is confined to availability impact with no confidentiality or integrity exposure, and the CVSS 4.0 local attack vector limits remote exploitation to indirect paths such as network-facing EXR parsing pipelines. No public exploit code or active exploitation has been identified; a vendor-released patch is available in version 3.4.13.

MEDIUM

6.9

0.1%

35

CVE-2026-55373

Infinite-loop denial of service in OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 allows an attacker to permanently hang any process that parses a crafted EXR image by triggering an integer overflow in the sample-count helper roundListSizeUp(). When UINT_MAX is passed as a sample-count value, 32-bit unsigned left-shift arithmetic wraps the accumulator to zero, producing a loop condition that never terminates. The vulnerability is reachable through public OpenEXRUtil APIs, making it exploitable wherever applications accept externally-supplied EXR files. No public exploit code or CISA KEV listing has been identified at time of analysis.

MEDIUM

6.2

0.1%

31

CVE-2026-55059

Heap out-of-bounds write in OpenEXR's DeepImage API affects all versions prior to 3.2.10, 3.3.12, and 3.4.13, exploitable by processing a crafted deep image EXR file. A coordinate axis confusion bug in `Imf_4_0::SampleCountChannel::set()` uses `dataWindow.min.x` instead of `dataWindow.min.y` when computing a target Y coordinate, causing memory writes before the allocated `_numSamples` heap buffer when `min.x ≠ min.y`. No public exploit identified at time of analysis; SUSE Linux Enterprise distributions have received vendor-released patches confirming active remediation.

MEDIUM

6.1

0.1%

31

CVE-2026-68514

Heap buffer overflow in PyOpenEXR Python bindings versions 3.3.0-3.3.12 and 3.4.0-3.4.13 causes memory corruption and process crash when opening a crafted deep scanline EXR file. A specific channel naming collision - a literal channel 'left' coexisting with layer-prefixed 'left.R', 'left.G', 'left.B' - causes the wrapper to allocate scalar-shaped deep sample storage and then write into it at RGB stride (three lanes), overflowing the heap allocation. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 3.3.13 and 3.4.14.

MEDIUM

5.5

0.2%

28

CVE-2026-59983

Out-of-bounds read in OpenEXR's ILP32 builds enables denial of service via crafted uncompressed deep-tile EXR files across three active release branches (before 3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13). The root cause is a 32-bit integer overflow in OpenEXRCore's sample-count table size calculation that causes unpack_sample_table() to iterate beyond an undersized allocation. No public exploit or active exploitation has been identified; vendor-released patches are available for all three affected branches.

MEDIUM

5.5

0.2%

28

CVE-2026-59984

Out-of-bounds write in OpenEXR's B44 decompression path on ILP32 (32-bit) builds allows an attacker to corrupt heap memory and crash any application that opens a crafted EXR file, affecting the C++ libraries, CLI tools, and PyOpenEXR bindings across versions 3.1.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. When a malformed B44-compressed scanline image triggers integer truncation in the scratch buffer size calculation before allocation, uncompress_b44_impl() subsequently writes using the full attacker-controlled channel width into the undersized buffer, producing a heap out-of-bounds write. Patches are confirmed available in 3.2.11, 3.3.13, and 3.4.14; no public exploit is identified at time of analysis.

MEDIUM

5.5

0.2%

28

CVE-2026-59985

Heap out-of-bounds read in OpenEXR's RLE decompression path crashes the decoding process on ILP32 (32-bit) builds across versions 3.2.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. A crafted .exr file with a malicious RLE-compressed payload causes the 64-bit unpacked size to truncate before buffer allocation in OpenEXRCore decoding.c, after which unpack_32bit() reads past the allocated buffer boundary, resulting in denial of service. Exploitation requires a victim or automated pipeline to open the malicious file; no public exploit identified at time of analysis, and the vulnerability is constrained to ILP32 build environments.

MEDIUM

5.5

0.2%

28

Severity Breakdown

Monthly CVE Trend

Affected Products (4)

Top Risky CVEs