Homepage

Out-of-bounds Read Affecting openexr package, versions <3.4.14-0.1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.18% (8th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-OPENEXR-19270078
  • published26 Aug 2026
  • disclosed25 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 25 Aug 2026

NewCVE-2026-59985  (opens in a new tab)
CWE-125  (opens in a new tab)

How to fix?

Upgrade Debian:unstable openexr to version 3.4.14-0.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openexr package and not the openexr package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.