CVE-2026-59184: OpenEXR Use-After-Free Vulnerability

CVE-2026-59184 Overview

CVE-2026-59184 is a memory corruption vulnerability in OpenEXR, the reference implementation of the EXR image format used throughout the motion picture and visual effects industry. A crafted EXR file with a nonzero dataWindow.min causes TypedFlatImageChannel::row() to return an invalid heap pointer. Applications that subsequently write pixel rows through FlatHalfChannel::row() trigger out-of-bounds writes or use-after-free conditions [CWE-416]. The flaw affects OpenEXR versions prior to 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. Fixes are available in 3.2.11, 3.3.13, and 3.4.14.

Critical Impact
Attackers can trigger heap corruption in any tool, converter, renderer, or image-processing service that ingests untrusted EXR files, potentially leading to denial of service or code execution.

Affected Products

OpenEXR versions before 3.2.11
OpenEXR versions 3.3.0 through 3.3.12
OpenEXR versions 3.4.0 through 3.4.13

Discovery Timeline

2026-08-25 - CVE-2026-59184 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-59184

Vulnerability Analysis

The vulnerability resides in the OpenEXRUtil helper library, specifically in the templated row() accessor of TypedFlatImageChannel<T> and TypedDeepImageChannel<T>. These inline methods return a pointer to a specific row of pixel data by computing an offset from an internal _base pointer. When an EXR file declares a dataWindow whose min coordinate is nonzero, the _base pointer is pre-adjusted to account for the origin offset. Callers that pass an absolute row index into row() then dereference a pointer outside the allocated buffer.

Subsequent writes through FlatHalfChannel::row() corrupt adjacent heap memory. Because the corrupted region is under partial attacker control through the pixel payload, this behavior enables reliable heap manipulation. The condition is classified as a use-after-free by the maintainers because the returned pointer can also alias freed memory in some allocation patterns.

Root Cause

The root cause is an incorrect base pointer used in the row-address calculation. The _base field was adjusted for the dataWindow.min origin, but row(int r) treated r as absolute rather than relative. The upstream fix replaces _base with the untranslated _pixels (or _sampleListPointers for deep channels), restoring the invariant that the pointer arithmetic operates on the actual buffer origin.

Attack Vector

Exploitation requires an application to load an attacker-supplied EXR file and iterate its rows using the affected OpenEXRUtil API. Render farms, asset ingestion pipelines, cloud transcoders, thumbnail services, and DCC plugins are all viable targets. User interaction is limited to opening or processing the file.

// Upstream patch: src/lib/OpenEXRUtil/ImfFlatImageChannel.h
 inline T*
 TypedFlatImageChannel<T>::row (int r)
 {
-    return _base + r * pixelsPerRow ();
+    return _pixels + r * pixelsPerRow ();
 }

 template <class T>
 inline const T*
 TypedFlatImageChannel<T>::row (int n) const
 {
-    return _base + n * pixelsPerRow ();
+    return _pixels + n * pixelsPerRow ();
 }
// Source: https://github.com/AcademySoftwareFoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1

Detection Methods for CVE-2026-59184

Indicators of Compromise

EXR files containing a dataWindow header whose min.x or min.y field is nonzero and inconsistent with expected pipeline outputs.
Crashes, SIGSEGV events, or heap sanitizer reports originating in TypedFlatImageChannel<T>::row or FlatHalfChannel::row.
Unexpected termination of image converters, render workers, or thumbnailer processes shortly after ingesting third-party EXR content.

Detection Strategies

Enumerate installed OpenEXR shared libraries and compare versions against the fixed releases 3.2.11, 3.3.13, and 3.4.14.
Run static software composition analysis on build artifacts and container images to identify vulnerable libOpenEXRUtil linkage.
Enable AddressSanitizer or heap guard pages in pre-production ingestion services to catch out-of-bounds writes triggered by fuzzed EXR corpora.

Monitoring Recommendations

Instrument EXR ingestion services with crash telemetry and forward stack traces to a centralized SIEM for correlation.
Alert on repeated worker restarts or OOM events on hosts that process user-uploaded imagery.
Track file uploads containing EXR magic bytes 0x76 0x2f 0x31 0x01 originating from untrusted tenants.

How to Mitigate CVE-2026-59184

Immediate Actions Required

Upgrade OpenEXR to 3.2.11, 3.3.13, or 3.4.14 on all systems that decode EXR content.
Rebuild and redeploy applications, containers, and DCC plugins that statically link libOpenEXRUtil.
Audit render farm nodes and cloud image processing workers for outdated OpenEXR versions bundled as vendored dependencies.

Patch Information

The Academy Software Foundation released fixes in commits 37f03b6, 55b7958, and aef0222. The patches replace the offset _base pointer with the buffer origin _pixels (or _sampleListPointers for deep channels). See GitHub Security Advisory GHSA-pqp9-558c-453q for the coordinated disclosure notice.

Workarounds

Reject or normalize EXR uploads with nonzero dataWindow.min values at the ingestion boundary.
Sandbox EXR processing in isolated containers with seccomp and read-only filesystems to contain memory corruption impact.
Route untrusted EXR content through a re-encoding step using a patched OpenEXR build before handing files to downstream consumers.

bash

# Verify installed OpenEXR version on Linux hosts
pkg-config --modversion OpenEXR

# Rebuild from a patched release tag
git clone --branch v3.4.14 https://github.com/AcademySoftwareFoundation/openexr.git
cmake -S openexr -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --target install