CVE-2026-59982

HighCVSS 7.1/10Last modified Sep 9, 2026

Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-190CWE-787

Affected software

VendorProductVersions
AcademySoftwareFoundationopenexr>= 3.1.0, < 3.2.11; >= 3.3.0, < 3.3.13; >= 3.4.0, < 3.4.14

References

Timeline

Published
Aug 25, 2026
Last modified
Sep 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-599835.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versCVE-2026-599845.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versCVE-2026-599855.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versCVE-2026-599867.4rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len ovCVE-2026-599899.2Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep bCVE-2026-59996.3A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such mCVE-2026-599907.5Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depthCVE-2026-599917.5psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocatCVE-2026-599925.4Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-CVE-2026-599936.5Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through CVE-2026-599944.3EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an emailCVE-2026-599955.4sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker