CVE-2026-59982

A flaw was found in OpenEXR. A remote attacker could provide a specially crafted deep EXR image file, which, when processed by a user, could lead to an out-of-bounds pointer being returned by the TypedDeepImageChannel::row() function. This vulnerability could cause the application to crash (Denial of Service) or result in limited information disclosure.

Red Hat has classified this vulnerability as having an Important impact because an attacker can potentially crash applications or read uninitialized memory by supplying manipulated image files. In Red Hat Enterprise Linux environments, OpenEXR is consumed as a shared rendering library by graphical utilities and multimedia applications rather than deployed as an exposed network service. Successful exploitation requires an end user or automated pipeline to load an untrusted deep image file, limiting the blast radius to the executing process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing untrusted EXR image files with applications linked against OpenEXR. Users should exercise caution when handling EXR files from unknown or suspicious sources.