CVE-2026-59985

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59985", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-07T19:41:00.004Z", "datePublished": "2026-08-25T18:16:37.986Z", "dateUpdated": "2026-08-25T19:16:49.514Z"}, "containers": {"cna": {"title": "OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm"}, {"name": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11"}, {"name": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13"}, {"name": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14"}], "affected": [{"vendor": "AcademySoftwareFoundation", "product": "openexr", "versions": [{"version": ">= 3.2.0, < 3.2.11", "status": "affected"}, {"version": ">= 3.3.0, < 3.3.13", "status": "affected"}, {"version": ">= 3.4.0, < 3.4.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-25T18:16:37.986Z"}, "descriptions": [{"lang": "en", "value": "OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14."}], "source": {"advisory": "GHSA-v6v5-344m-64vm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T19:16:22.146974Z", "id": "CVE-2026-59985", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:16:49.514Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59985", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:16:22.146974Z"}}}], "references": [{"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:16:40.362Z"}}], "cna": {"title": "OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32", "source": {"advisory": "GHSA-v6v5-344m-64vm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "AcademySoftwareFoundation", "product": "openexr", "versions": [{"status": "affected", "version": ">= 3.2.0, < 3.2.11"}, {"status": "affected", "version": ">= 3.3.0, < 3.3.13"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.14"}]}], "references": [{"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm", "name": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11", "name": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13", "name": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14", "name": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-25T18:16:37.986Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59985", "state": "PUBLISHED", "dateUpdated": "2026-08-25T19:16:49.514Z", "dateReserved": "2026-07-07T19:41:00.004Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-25T18:16:37.986Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openexr", "vendor": "AcademySoftwareFoundation", "versions": [{"status": "affected", "version": ">= 3.2.0, < 3.2.11"}, {"status": "affected", "version": ">= 3.3.0, < 3.3.13"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.14"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14."}], "id": "CVE-2026-59985", "lastModified": "2026-09-09T21:07:31.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59985", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T19:16:22.146974Z", "version": "2.0.3"}}]}, "published": "2026-08-25T19:16:51.820", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11"}, {"source": "security-advisories@github.com", "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13"}, {"source": "security-advisories@github.com", "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14"}, {"source": "security-advisories@github.com", "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "openexr: OpenEXR: Denial of Service via heap out-of-bounds read with crafted EXR image", "id": "2523718", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523718"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.", "A flaw was found in OpenEXR. A remote attacker could provide a specially crafted RLE-compressed EXR image, which causes a 64-bit unpacked size to truncate before memory allocation. This leads to a heap out-of-bounds read when unpack_32bit() attempts to read beyond the allocated buffer. Successful exploitation of this vulnerability could result in a denial of service (DoS) for the affected system."], "mitigation": {"lang": "en:us", "value": "Red Hat does not ship OpenEXR versions 3.2.0 or later where this vulnerability was introduced. No mitigation is necessary for Red Hat products."}, "name": "CVE-2026-59985", "public_date": "2026-08-25T18:16:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59985\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59985\nhttps://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11\nhttps://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13\nhttps://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14\nhttps://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm"], "statement": "A flaw was found in OpenEXR where a heap out-of-bounds read can occur when processing a specially crafted RLE-compressed EXR image file. This vulnerability only affects 32-bit ILP32 builds and was introduced in OpenEXR version 3.2.0; 64-bit LP64 builds are not vulnerable. Red Hat products ship OpenEXR versions below 3.2.0 (RHEL 9 ships 3.1.1, RHEL 10 ships 3.1.10) and therefore do not contain the vulnerable code. When exploited on vulnerable 32-bit builds with affected versions, this issue can lead to denial of service.", "threat_severity": "Moderate"}

{"created": "2026-08-25T20:15:04.776969+00:00", "updated": "2026-09-10T14:00:10.720677+00:00", "vendors": []}