---
id: CVE-2026-59985
title: >-
  OpenEXR is the reference implementation and specification for the EXR image
  format, widely used in the motion picture industry
summary: >-
  OpenEXR is the reference implementation and specification for the EXR image
  format, widely used in the motion picture industry. OpenEXR versions 3.2.0
  through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable
  on ILP32…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-125
vendor: AcademySoftwareFoundation
product: openexr
affected:
  - 'openexr >= 3.2.0, < 3.2.11'
  - 'openexr >= 3.3.0, < 3.3.13'
  - 'openexr >= 3.4.0, < 3.4.14'
published: '2026-08-25'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:07:31.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59985'
references:
  - url: 'https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11'
    label: security-advisories@github.com
  - url: 'https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13'
    label: security-advisories@github.com
  - url: 'https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14'
    label: security-advisories@github.com
  - url: >-
      https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm
    label: security-advisories@github.com
  - url: >-
      https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-25T19:16:22.146974Z'
ingestedAt: '2026-09-13T02:34:32.078Z'
epss: 0.00172
epssPercentile: 0.05836
---

## Overview

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.