Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenEXR 2.3.0-6 can crash when processing bad image
published 2 months ago
Summary
The OpenEXR library version 2.3.0-6 can be forced to read beyond its memory limits when it handles a specially crafted EXR image file. This can cause the application to stop working, leading to a denial of service. Upgrade to a newer OpenEXR release (3.2.11 or later) to resolve the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | openexr | <= 2.3.0-6 |
Original advisory text
CVE-2026-59983 affecting package OpenEXR 2.3.0-6
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds read. The vulnerability is reached when a crafted uncompressed deep-tile EXR causes the sample-count table size calculation in OpenEXRCore decoding.c to wrap before unpack_sample_table() iterates over the full attacker-controlled tile dimensions, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
References
Timeline
Published25 Aug 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-97628 · OSV
Track software like this
Free during beta