---
id: CVE-2026-59984
title: >-
  OpenEXR is the reference implementation and specification for the EXR image
  format, widely used in the motion picture industry
summary: >-
  OpenEXR is the reference implementation and specification for the EXR image
  format, widely used in the motion picture industry. OpenEXR versions 3.1.0
  through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable
  on ILP32…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-787
vendor: AcademySoftwareFoundation
product: openexr
affected:
  - 'openexr >= 3.1.0, < 3.2.11'
  - 'openexr >= 3.3.0, < 3.3.13'
  - 'openexr >= 3.4.0, < 3.4.14'
published: '2026-08-25'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:07:31.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59984'
references:
  - url: 'https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11'
    label: security-advisories@github.com
  - url: 'https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13'
    label: security-advisories@github.com
  - url: 'https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14'
    label: security-advisories@github.com
  - url: >-
      https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-92pq-9qv4-g68q
    label: security-advisories@github.com
  - url: >-
      https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-92pq-9qv4-g68q
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-25T18:34:19.859344Z'
ingestedAt: '2026-09-14T08:35:14.929Z'
epss: 0.0018
epssPercentile: 0.07819
---

## Overview

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.