CVE-2026-59183

MediumCVSS 5.5/10Last modified Oct 12, 2026

Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, an int32_t multiplication in OpenEXRCore's unpack_sample_table() can overflow while decoding a crafted deep tiled EXR file, producing an invalid pointer that leads to a read from an unmapped memory address and a crash. Because the overflow occurs in the standard decoding path (exr_decoding_run), any application that decodes deep tiled EXR files is affected. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
AcademySoftwareFoundation	openexr	>= 3.1.0, < 3.2.11; >= 3.3.0, < 3.3.13; >= 3.4.0, < 3.4.14

References

Timeline

Published: Aug 25, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-591847.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions bef CVE-2026-591858.5identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/CVE-2026-591867.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions CVE-2026-591877.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR vers CVE-2026-591885.4Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files CVE-2026-591897.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUt CVE-2026-59196.5Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromis CVE-2026-591908.7grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an au CVE-2026-591916.9TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensi CVE-2026-591926.9TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensi CVE-2026-591934.9Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a speciall CVE-2026-591947.1pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cau