CVE-2026-59985 Overview
CVE-2026-59985 is a heap out-of-bounds read vulnerability in OpenEXR, the reference implementation and specification for the EXR image format used across the motion picture industry. The flaw affects ILP32 builds of OpenEXR when decoding crafted RLE-compressed EXR files. A 64-bit unpacked size value truncates before allocation in OpenEXRCore/decoding.c, causing unpack_32bit() to read beyond the resulting buffer. Successful exploitation results in denial of service. The vulnerability is tracked under [CWE-125] Out-of-Bounds Read and is fixed in OpenEXR versions 3.2.11, 3.3.13, and 3.4.14.
Critical Impact
A crafted EXR image processed by a vulnerable ILP32 build triggers a heap out-of-bounds read in unpack_32bit(), resulting in denial of service of the decoding application.
Affected Products
- OpenEXR versions 3.2.0 through 3.2.10 (ILP32 builds)
- OpenEXR versions 3.3.0 through 3.3.12 (ILP32 builds)
- OpenEXR versions 3.4.0 through 3.4.13 (ILP32 builds)
Discovery Timeline
- 2026-08-25 - CVE-2026-59985 published to the National Vulnerability Database
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-59985
Vulnerability Analysis
The vulnerability resides in the OpenEXR Core decoding path that handles Run-Length Encoded (RLE) compressed pixel data. On ILP32 platforms, where long and pointer types are 32 bits wide, a 64-bit unpacked size value computed during decoding is narrowed before it is used to allocate the destination buffer. This numeric truncation produces an undersized allocation while the decoder still believes the buffer holds the full uncompressed payload.
When unpack_32bit() executes against this undersized buffer, it reads past the end of the heap allocation. The out-of-bounds access does not corrupt attacker-controlled data structures but causes the process to terminate or return invalid data, producing denial of service. Confidentiality and integrity are not directly impacted based on the reported CVSS vector. Exploitation requires a local user to open or process a crafted EXR file with a vulnerable ILP32 build of OpenEXR.
Root Cause
The defect is a numeric truncation error in OpenEXRCore/decoding.c. The 64-bit unpacked-size calculation is stored into a smaller integer type used for allocation sizing on ILP32 targets. The allocator returns a buffer sized to the truncated value, while the unpack loop iterates based on the pre-truncation size, producing an out-of-bounds heap read in unpack_32bit().
Attack Vector
An attacker crafts an EXR file whose RLE-compressed payload declares an unpacked size that overflows a 32-bit size type. The attacker delivers this file to a target that processes untrusted EXR content using a vulnerable ILP32 build. Any tool, plugin, or service that embeds an affected OpenEXR version is a candidate for triggering the fault. User interaction is required, consistent with a local attack vector.
No public proof-of-concept has been published at the time of writing. See the GitHub Security Advisory GHSA-v6v5-344m-64vm for the maintainer analysis and the corrected size handling in the fixed releases.
Detection Methods for CVE-2026-59985
Indicators of Compromise
- Crashes or abnormal terminations in processes that link OpenEXR when opening .exr files, particularly on 32-bit builds.
- Untrusted EXR files delivered through email, shared storage, or asset-ingest pipelines that target render farms and content workflows.
- Application logs referencing unpack_32bit or OpenEXRCore/decoding.c faults during image decode.
Detection Strategies
- Inventory installed OpenEXR versions across build hosts, render nodes, and creative workstations and flag any ILP32 build in the affected version ranges.
- Enable AddressSanitizer or equivalent heap instrumentation in test environments to surface out-of-bounds reads during EXR ingestion fuzzing.
- Monitor endpoint telemetry for repeated crashes of image-processing utilities such as oiiotool, DCC applications, or custom decoders that embed OpenEXR.
Monitoring Recommendations
- Alert on unexpected termination of long-running media services that consume EXR content from external sources.
- Track file-open events for .exr files originating from untrusted network shares or downloaded artifacts.
- Review software composition analysis (SCA) output for OpenEXR versions below 3.2.11, 3.3.13, or 3.4.14.
How to Mitigate CVE-2026-59985
Immediate Actions Required
- Upgrade OpenEXR to 3.2.11, 3.3.13, or 3.4.14 on all affected systems, prioritizing ILP32 builds used in production pipelines.
- Identify downstream applications and plugins that statically link OpenEXR and rebuild them against a fixed version.
- Restrict processing of EXR files sourced from untrusted origins until patched binaries are deployed.
Patch Information
The OpenEXR maintainers released fixes in the following versions: OpenEXR v3.2.11, OpenEXR v3.3.13, and OpenEXR v3.4.14. Each release corrects the size handling in OpenEXRCore/decoding.c so that the 64-bit unpacked size is validated before allocation. Refer to the GitHub Security Advisory GHSA-v6v5-344m-64vm for full advisory details.
Workarounds
- Where feasible, migrate ILP32 workloads to 64-bit LP64 builds, which are not affected by the truncation.
- Validate EXR file provenance and reject files from untrusted senders at the perimeter or ingest gateway.
- Sandbox EXR decoding in isolated processes so that a decoder crash does not terminate the parent application or pipeline.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
