CVE-2026-59187

OpenEXR: exrmetrics deep pixelmode heap buffer overflow

State: Published
Severity: 7.1 High
Published: Aug 25, 2026
Updated: Aug 25, 2026
Reserved: Jul 2, 2026

Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H	GitHub_M

Weaknesses

CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
openexrAcademySoftwareFoundation	>= 3.3.0, < 3.3.13Affected >= 3.4.0, < 3.4.14Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.