CVE-2026-59983 OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32
A crafted EXR file triggers an integer overflow leading to an out-of-bounds read and denial of service in OpenEXR on ILP32 systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59983?
CVE-2026-59983 is a medium-severity vulnerability in AcademySoftwareFoundation openexr, published on 25 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds read. The vulnerability is reached when a crafted uncompressed deep-tile EXR causes the sample-count table size calculation in OpenEXRCore decoding.c to wrap before unpack_sample_table() iterates over the full attacker-controlled tile dimensions, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Weakness: CWE-125
Which versions are affected by CVE-2026-59983?
How do I fix CVE-2026-59983?
Upgrade to a fixed version.
Is CVE-2026-59983 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59983 exists.
Sources
Also known as AZL-97628, BELL-CVE-2026-59983, DEBIAN-CVE-2026-59983, ECHO-d3cf-a68b-8d46, GHSA-p42q-g5c9-mh9w, MINI-2pcv-78gm-3xrw and 1 more.