CVE-2026-59189 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin
An out-of-bounds read in OpenEXRUtil allows attackers to cause crashes or disclose information via crafted deep images with non-zero dataWindow origins.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59189?
CVE-2026-59189 is a high-severity memory corruption vulnerability in AcademySoftwareFoundation openexr, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel<T>::row() API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin, resulting in a heap out-of-bounds read and crash, with potential information disclosure under a controlled heap layout. The flaw arises because ImfDeepImageChannel uses two conflicting coordinate models: at(x, y) uses absolute coordinates (with _base offset by dataWindow.min), while row(r) is documented as 0-based logical access. For a non-zero dataWindow.min, row(0) therefore points outside the _sampleListPointers allocation instead of at the first logical row. This issue is fixed in versions 3.3.13 and 3.4.13.
Weakness: CWE-125
Which versions are affected by CVE-2026-59189?
How do I fix CVE-2026-59189?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-59189 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59189 exists.
Sources
Also known as AZL-97637, BELL-CVE-2026-59189, DEBIAN-CVE-2026-59189, ECHO-ec93-6da5-dcb2, GHSA-hwmv-39v6-739m, MINI-56hf-r542-h779 and 4 more.