Executive brief
OpenEXR is the standard format for professional image and video processing used across the motion picture industry. A vulnerability in 32-bit builds allows a maliciously crafted EXR image file to cause a crash (denial of service) when opened in any application using OpenEXR libraries or command-line tools. While the impact is limited to denial of service on affected systems, EXR files are commonly used in production pipelines, making this a priority patch for organizations processing untrusted image files.
Technical details
This vulnerability is a heap out-of-bounds read caused by integer overflow in the RLE decompression logic within OpenEXRCore's decoding.c on ILP32 (32-bit) architectures. When processing a crafted RLE-compressed EXR file, the 64-bit unpacked size is truncated to 32 bits before memory allocation, resulting in an undersized buffer. The unpack_32bit() function then reads beyond this buffer boundary, causing a crash. The vulnerability does not affect standard 64-bit desktop and server builds, but impacts 32-bit Linux, embedded systems, and some mobile/CI targets. Patches are available in versions 3.2.11, 3.3.13, and 3.4.14.
Affected products
- Academy Software Foundation OpenEXR 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, 3.4.0 through 3.4.13 (on ILP32 builds)
Timeline
- 2026-08-25: disclosed: CVE-2026-59985 published
- 2026-08-07: patched: Fix released in versions 3.2.11, 3.3.13, and 3.4.14