CVE-2026-59981

A flaw was found in OpenEXR. An attacker can craft a malicious deep EXR image file that, when opened by an application, can lead to an out-of-bounds read in the OpenEXRUtil library's SampleCountChannel::row() API. This vulnerability can result in information disclosure, where adjacent heap memory is returned as sample-count values, or a denial of service due to a process crash.

This vulnerability is rated as having Important impact because processing a maliciously crafted image file can trigger an unhandled process termination or expose sensitive heap memory to an attacker. In Red Hat Enterprise Linux environments, OpenEXR libraries are consumed by multimedia utilities and graphics-processing pipelines that handle user-supplied graphic assets. While exploitation requires an application or user to open an untrusted file, automated ingestion workflows and desktop applications processing untrusted media remain directly exposed to denial of service or data leakage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing untrusted or unverified EXR image files with applications linked against the OpenEXR library. Additionally, consider running applications that handle EXR files within a sandboxed environment to limit the potential impact of successful exploitation.