Medium [CVE-2026-59985] Denial of Service via heap out-of-bounds read with crafted EXR image
This medium-severity Red Hat Linux advisory covers CVE-2026-59985.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read.
The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
A flaw was found in OpenEXR. This leads to a heap out-of-bounds read when unpack_32bit() attempts to read beyond the allocated buffer.
Successful exploitation of this vulnerability could result in a denial of service (DoS) for the affected system. Red Hat products ship OpenEXR versions below 3.2.0 (RHEL 9 ships 3.1.1, RHEL 10 ships 3.1.10) and therefore do not contain the vulnerable code.
When exploited on vulnerable 32-bit builds with affected versions, this issue can lead to denial of service. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
Weakness: CWE-805.
- 3.2.0
- 3.2.10
- 3.3.0
- 3.3.12
- 3.4.0
- 3.4.13
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
- 3.2.11
- 3.3.13
- 3.4.14
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Red Hat does not ship OpenEXR versions 3.2.0 or later where this vulnerability was introduced. No mitigation is necessary for Red Hat products.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.