CVE-2026-59189 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel::row API can return an out-of-bounds pointer when a deep imag...

EUVD-2026-65593

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel::row API can return an out-of-bounds pointer when a deep imag...

CVE-2026-59189

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel::row API can return an out-of-bounds pointer when a deep imag...

CVE-2026-59189

OpenEXRUtil (the reference implementation for the EXR image format used in the motion picture industry) is affected in versions 3.3.0–3.3.12 and 3.4.0–3.4.12 by a heap out-of-bounds read in the TypedDeepImageChannel::row() API. The root cause is a conflict between two coordinate models: at(x, y) ...

PT-2026-81498

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description The OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::row API when a deep image has a...

PT-2026-81419

Name of the Vulnerable Software and Affected Versions OpenEXRUtil versions 3.3.0 through 3.3.12 OpenEXRUtil versions 3.4.0 through 3.4.12 Description The TypedDeepImageChannel::row API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin. This occurs because...

PT-2026-81460

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description An issue exists where the TypedDeepImageChannel::row function can return an out-of-bounds pointer when processing a crafte...