CVE-2026-59187 OpenEXR: exrmetrics deep pixelmode heap buffer overflow
A heap buffer overflow in OpenEXR allows attackers to execute arbitrary code or cause denial of service via crafted deep scanline EXR files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59187?
CVE-2026-59187 is a high-severity memory corruption vulnerability in AcademySoftwareFoundation openexr, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT output while the backing sample buffers are allocated using the input HALF element size. The issue is fixed in versions 3.3.13 and 3.4.14.
Which versions are affected by CVE-2026-59187?
How do I fix CVE-2026-59187?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-59187 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59187 exists.
Sources
Also known as BELL-CVE-2026-59187, DEBIAN-CVE-2026-59187, GHSA-6jj8-cxcr-j8hm, MINI-83fg-28hx-rxg4, ROOT-OS-DEBIAN-11-CVE-2026-59187, ROOT-OS-DEBIAN-12-CVE-2026-59187 and 2 more.