CVE-2026-59183: OpenEXR Buffer Overflow Vulnerability

CVE-2026-59183 Overview

CVE-2026-59183 is an integer overflow vulnerability [CWE-190] in OpenEXR, the reference implementation for the EXR image format used across the motion picture industry. The flaw resides in the unpack_sample_table() function within OpenEXRCore and triggers when the library decodes a crafted deep tiled EXR file. A signed int32_t multiplication overflows, producing an invalid pointer that leads to a read from unmapped memory and a process crash. Any application invoking exr_decoding_run on deep tiled EXR files inherits this exposure. The issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Critical Impact
A malicious deep tiled EXR file can crash any application built on affected OpenEXR versions, disrupting rendering pipelines, media processing services, and content review workflows.

Affected Products

OpenEXR versions 3.1.0 through 3.2.10
OpenEXR versions 3.3.0 through 3.3.12
OpenEXR versions 3.4.0 through 3.4.13

Discovery Timeline

2026-08-25 - CVE-2026-59183 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-59183

Vulnerability Analysis

The defect sits in the standard decoding path exercised by exr_decoding_run, which makes it reachable from any consumer of the OpenEXR C core. When decoding a deep tiled chunk, unpack_sample_table() computes the total pixel count using signed 32-bit arithmetic on the chunk width and height values parsed from file metadata. A crafted file can supply dimensions whose product exceeds INT32_MAX, causing the multiplication to wrap. The wrapped value is then used to derive offsets into the sample count table, producing an invalid pointer that is dereferenced during subsequent reads.

The result is a read from an unmapped address and an application crash. Because the flaw is triggered by parsing untrusted image data, exploitation only requires convincing a user or automated pipeline to open a malicious .exr file.

Root Cause

The root cause is signed integer overflow in src/lib/OpenEXRCore/decoding.c. The local variables w and h were declared as int32_t, so their product overflowed before being promoted to a wider type. The fix widens both variables to int64_t, allowing the multiplication to be performed in 64-bit space and preserving the correct result.

Attack Vector

Exploitation requires local file access and user interaction: a victim must open or process a crafted deep tiled EXR file with a vulnerable application. The impact is limited to availability. No code execution, information disclosure, or privilege escalation is described in the advisory.

 unpack_sample_table (exr_const_context_t ctxt, exr_decode_pipeline_t* decode)
 {
     exr_result_t rv           = EXR_ERR_SUCCESS;
-    int32_t      w            = decode->chunk.width;
-    int32_t      h            = decode->chunk.height;
+    int64_t      w            = decode->chunk.width;
+    int64_t      h            = decode->chunk.height;
     uint64_t     totsamp      = 0;
     int32_t*     samptable    = decode->sample_count_table;
     size_t       combSampSize = 0;

Source: OpenEXR commit 5e55a64. The patch promotes w and h from int32_t to int64_t so the width-by-height multiplication cannot overflow before use.

Detection Methods for CVE-2026-59183

Indicators of Compromise

Repeated crashes or segmentation faults in processes linked against libOpenEXR or libOpenEXRCore when opening .exr files
Deep tiled EXR files with unusually large width or height header values whose product exceeds INT32_MAX
Core dumps referencing unpack_sample_table or exr_decoding_run in the crashing stack frame

Detection Strategies

Inventory applications and containers that bundle OpenEXR (rendering software, VFX pipelines, image thumbnailers, web preview services) and compare linked versions against 3.2.11, 3.3.13, and 3.4.14.
Use software composition analysis to flag OpenEXR versions in the affected ranges within build artifacts and container images.
Parse EXR headers before decoding and reject files whose reported deep tile dimensions are inconsistent with the file size.

Monitoring Recommendations

Alert on abnormal termination of media processing workers or rendering nodes that consume user-supplied EXR files.
Correlate crash telemetry with recently ingested .exr files to identify malicious inputs.
Monitor file gateways for EXR uploads carrying extreme dimension fields in the header.

How to Mitigate CVE-2026-59183

Immediate Actions Required

Upgrade OpenEXR to 3.2.11, 3.3.13, or 3.4.14 depending on your current branch.
Rebuild and redeploy any application, container, or plugin that statically links or vendors OpenEXR.
Audit third-party software that depends on OpenEXR and apply vendor updates as they become available.

Patch Information

The upstream fix is tracked in the GitHub Security Advisory GHSA-rqp5-pmwm-wj6x and delivered through three commits across supported branches: commit 5e55a64, commit a6cf183, and commit e2adb5b. Each commit widens w and h in unpack_sample_table() to int64_t.

Workarounds

Disable or gate deep tiled EXR decoding paths in applications where the format is not required.
Restrict EXR ingestion to trusted sources and enforce content validation on uploaded image files.
Run image decoding services under process isolation so a crash cannot cascade to other workloads.

bash

# Verify installed OpenEXR version on Linux hosts
pkg-config --modversion OpenEXR

# Debian/Ubuntu: check package version
dpkg -l | grep -i openexr

# Rebuild from source against a fixed release
git clone https://github.com/AcademySoftwareFoundation/openexr.git
cd openexr
git checkout v3.4.14
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --target install