CVE-2026-59186

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59186
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59186.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59186
Aliases
  • GHSA-f667-c4wm-c8gq
Downstream
ALSA (1)
AZL (1)
BELL (1)
CLSA (2)
DEBIAN (1)
ECHO (1)
MINI (1)
openSUSE (3)
RHSA (1)
RLSA (1)
ROOT (3)
SUSE (3)
UBUNTU (1)
Related
ALSA (1)
openSUSE (3)
SUSE (3)
Published
2026-08-25T16:35:58Z
Modified
2026-10-28T11:18:10Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVSS Calculator
Summary
OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds
Details

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 tile size. On ILP32, the Array2D tile-conversion buffer size calculation overflows, allocates a much smaller heap buffer, and tile decode writes past that allocation. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-122",
        "CWE-190",
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59186.json"
}
References

Affected packages

Git / github.com/academysoftwarefoundation/openexr

Affected ranges

Type
GIT
Repo
https://github.com/academysoftwarefoundation/openexr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ba4b1af3a096e8f69e1836b210976585189a5fca
Introduced
c7d3eac70ccde2c4ed484c6638b83ba872f71464
Fixed
ca50a6bb1f64c4d53362e4b67aec33e67cb7d425
Introduced
20a65852895894434bea88613f6d29ac8e88bd6e
Fixed
777d231a179de1711d2a942810d9559216ab3f4c
Fixed
71907b44ce9a1b05bf3934b8a7821752750731ab
Fixed
904141d3a1f86327ad1e2b93fc92ce2dd5881d34
Fixed
b1a5887372772d79328f4eb42b7f86352a38170b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "3.2.11"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "3.3.0"
                },
                {
                    "fixed":  "3.3.13"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "3.4.0"
                },
                {
                    "fixed":  "3.4.14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "71907b44ce9a1b05bf3934b8a7821752750731ab"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "904141d3a1f86327ad1e2b93fc92ce2dd5881d34"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "b1a5887372772d79328f4eb42b7f86352a38170b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
OPENEXR_1_0_4
v1.*
v1.7.1
v2.*
v2.0.0
v2.0.0.GM
v2.0.1
v2.1.0
v2.3.0
v2.4.0
v2.4.0-beta.1
v2.5.0
v3.*
v3.0.0-beta
v3.2.0
v3.2.0-rc
v3.2.0-rc2
v3.2.0-rc3
v3.2.0-rc4
v3.2.1
v3.2.1-rc
v3.2.10
v3.2.10-rc
v3.2.2
v3.2.2-rc
v3.2.2-rc2
v3.2.3
v3.2.3-rc
v3.2.3-rc2
v3.2.4
v3.2.4-rc
v3.2.4-rc2
v3.2.5
v3.2.5-rc
v3.2.6
v3.2.6-rc
v3.2.7
v3.2.7-rc
v3.2.8
v3.2.8-rc
v3.2.9
v3.2.9-rc
v3.3.0
v3.3.0-rc2
v3.3.1
v3.3.1-rc
v3.3.10
v3.3.10-rc
v3.3.10-rc2
v3.3.11
v3.3.11-rc3
v3.3.12
v3.3.12-rc
v3.3.2
v3.3.2-rc
v3.3.2-rc2
v3.3.2-rc3
v3.3.2-rc4
v3.3.3
v3.3.3-rc
v3.3.3-rc1
v3.3.4
v3.3.4-rc
v3.3.5
v3.3.5-rc
v3.3.5-rc3
v3.3.6
v3.3.6-rc
v3.3.6-rc2
v3.3.6-rc3
v3.3.6-rc4
v3.3.7
v3.3.7-rc
v3.3.7-rc2
v3.3.7-rc3
v3.3.7-rc4
v3.3.8
v3.3.8-rc
v3.3.9
v3.3.9-rc
v3.3.9-rc2
v3.4.0
v3.4.1
v3.4.1-rc
v3.4.1-rc2
v3.4.10
v3.4.10-rc
v3.4.11
v3.4.11-rc
v3.4.11-rc2
v3.4.11-rc3
v3.4.12
v3.4.12-rc2
v3.4.13
v3.4.13-rc
v3.4.13-rc2
v3.4.13-rc3
v3.4.2
v3.4.2-rc
v3.4.2-rc2
v3.4.3
v3.4.3-rc
v3.4.3-rc2
v3.4.3-rc3
v3.4.4
v3.4.4-rc
v3.4.4-rc2
v3.4.5
v3.4.5-rc
v3.4.6
v3.4.6-rc
v3.4.7
v3.4.7-rc
v3.4.8
v3.4.8-rc
v3.4.9
v3.4.9-rc

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59186.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "301968754882206035157465707581327051425",
            "length":  171
        },
        "id":  "CVE-2026-59186-00e41d87",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/71907b44ce9a1b05bf3934b8a7821752750731ab",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeEraseUnsafe"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "28434719284142737571542610321494299776",
                "191845802378330111474227194362479101313",
                "37834929009855024185181653899350123874",
                "139955292548233292519974535455096399305",
                "142454140834225312160459682055578168125",
                "310358716567860998430443038298781656597",
                "35043867481592626383247318612771504367",
                "224436485764137224186975328661448020264",
                "194615513715872496882916517291039026428",
                "60368976300734351294798610898890509871",
                "101449293593168675017373969910139534319",
                "239093831977253793124999150601392953863",
                "287174619313785404391970258216800988429",
                "194329491900079131433454685595271036823",
                "254877724218902816241731150966713151669",
                "196277127498438927543239043628954702421",
                "266907836867115164521361718746874187840",
                "39723225590271548484928701065244482340",
                "144946859423227541089826217682823337025",
                "6559351351303983556170719739669736683",
                "307034886755389493116206073988923087798",
                "191913776009992752170500837867982226336",
                "170474950192709945379560898565394346600",
                "339458384199779798312062634912604664490",
                "315160493000494115195636539342319226885",
                "196122556343981282398589452371095653565",
                "311068671904942499987962792848268789307",
                "52483218425228448976382260622474012563",
                "126486105663742925921704979803343376630",
                "158616668449181973034801371560482406168",
                "237890711713545565070174652396823696531",
                "267834542421922775051417978331182266325",
                "196993772799347830203649783630652012549"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59186-06101f57",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/b1a5887372772d79328f4eb42b7f86352a38170b",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "37153184844196883227477212752525787462",
            "length":  153
        },
        "id":  "CVE-2026-59186-0af4517c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/b1a5887372772d79328f4eb42b7f86352a38170b",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeErase"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "144132120777978148793646476236094322060",
            "length":  113
        },
        "id":  "CVE-2026-59186-1499a3ed",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/904141d3a1f86327ad1e2b93fc92ce2dd5881d34",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeErase"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "144132120777978148793646476236094322060",
            "length":  113
        },
        "id":  "CVE-2026-59186-1a90354f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/71907b44ce9a1b05bf3934b8a7821752750731ab",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeErase"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "301968754882206035157465707581327051425",
            "length":  171
        },
        "id":  "CVE-2026-59186-2cfd12b8",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/904141d3a1f86327ad1e2b93fc92ce2dd5881d34",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeEraseUnsafe"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "282242058557886710654782101866980497198",
            "length":  74
        },
        "id":  "CVE-2026-59186-4da35d8b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/71907b44ce9a1b05bf3934b8a7821752750731ab",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "Array"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "265665577907870632781156480613264583279",
            "length":  117
        },
        "id":  "CVE-2026-59186-55f6e0cd",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/b1a5887372772d79328f4eb42b7f86352a38170b",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeEraseUnsafe"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "28434719284142737571542610321494299776",
                "191845802378330111474227194362479101313",
                "37834929009855024185181653899350123874",
                "139955292548233292519974535455096399305",
                "142454140834225312160459682055578168125",
                "310358716567860998430443038298781656597",
                "35043867481592626383247318612771504367",
                "224436485764137224186975328661448020264",
                "194615513715872496882916517291039026428",
                "60368976300734351294798610898890509871",
                "101449293593168675017373969910139534319",
                "239093831977253793124999150601392953863",
                "287174619313785404391970258216800988429",
                "194329491900079131433454685595271036823",
                "254877724218902816241731150966713151669",
                "196277127498438927543239043628954702421",
                "266907836867115164521361718746874187840",
                "39723225590271548484928701065244482340",
                "144946859423227541089826217682823337025",
                "6559351351303983556170719739669736683",
                "307034886755389493116206073988923087798",
                "191913776009992752170500837867982226336",
                "170474950192709945379560898565394346600",
                "339458384199779798312062634912604664490",
                "315160493000494115195636539342319226885",
                "196122556343981282398589452371095653565",
                "311068671904942499987962792848268789307",
                "52483218425228448976382260622474012563",
                "126486105663742925921704979803343376630",
                "158616668449181973034801371560482406168",
                "237890711713545565070174652396823696531",
                "267834542421922775051417978331182266325",
                "196993772799347830203649783630652012549"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59186-623d5cb8",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/904141d3a1f86327ad1e2b93fc92ce2dd5881d34",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "265665577907870632781156480613264583279",
            "length":  117
        },
        "id":  "CVE-2026-59186-709ed20e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/904141d3a1f86327ad1e2b93fc92ce2dd5881d34",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeEraseUnsafe"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "282242058557886710654782101866980497198",
            "length":  74
        },
        "id":  "CVE-2026-59186-873f67ba",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/b1a5887372772d79328f4eb42b7f86352a38170b",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "Array"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "301968754882206035157465707581327051425",
            "length":  171
        },
        "id":  "CVE-2026-59186-8f525eaf",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/b1a5887372772d79328f4eb42b7f86352a38170b",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeEraseUnsafe"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "192893443401541802342820066125117927182",
            "length":  116
        },
        "id":  "CVE-2026-59186-94e612c9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/904141d3a1f86327ad1e2b93fc92ce2dd5881d34",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "Array2D"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "265665577907870632781156480613264583279",
            "length":  117
        },
        "id":  "CVE-2026-59186-b15ee1b8",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/71907b44ce9a1b05bf3934b8a7821752750731ab",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeEraseUnsafe"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "37153184844196883227477212752525787462",
            "length":  153
        },
        "id":  "CVE-2026-59186-b1750234",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/904141d3a1f86327ad1e2b93fc92ce2dd5881d34",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeErase"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "28434719284142737571542610321494299776",
                "191845802378330111474227194362479101313",
                "37834929009855024185181653899350123874",
                "139955292548233292519974535455096399305",
                "142454140834225312160459682055578168125",
                "310358716567860998430443038298781656597",
                "35043867481592626383247318612771504367",
                "224436485764137224186975328661448020264",
                "194615513715872496882916517291039026428",
                "60368976300734351294798610898890509871",
                "101449293593168675017373969910139534319",
                "239093831977253793124999150601392953863",
                "287174619313785404391970258216800988429",
                "194329491900079131433454685595271036823",
                "254877724218902816241731150966713151669",
                "196277127498438927543239043628954702421",
                "266907836867115164521361718746874187840",
                "39723225590271548484928701065244482340",
                "144946859423227541089826217682823337025",
                "6559351351303983556170719739669736683",
                "307034886755389493116206073988923087798",
                "191913776009992752170500837867982226336",
                "170474950192709945379560898565394346600",
                "339458384199779798312062634912604664490",
                "315160493000494115195636539342319226885",
                "196122556343981282398589452371095653565",
                "311068671904942499987962792848268789307",
                "52483218425228448976382260622474012563",
                "126486105663742925921704979803343376630",
                "158616668449181973034801371560482406168",
                "237890711713545565070174652396823696531",
                "267834542421922775051417978331182266325",
                "196993772799347830203649783630652012549"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59186-c0de3cdf",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/71907b44ce9a1b05bf3934b8a7821752750731ab",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "144132120777978148793646476236094322060",
            "length":  113
        },
        "id":  "CVE-2026-59186-db30c18d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/b1a5887372772d79328f4eb42b7f86352a38170b",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeErase"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "192893443401541802342820066125117927182",
            "length":  116
        },
        "id":  "CVE-2026-59186-ea08f2a9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/71907b44ce9a1b05bf3934b8a7821752750731ab",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "Array2D"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "37153184844196883227477212752525787462",
            "length":  153
        },
        "id":  "CVE-2026-59186-ee25de12",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/71907b44ce9a1b05bf3934b8a7821752750731ab",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "resizeErase"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "192893443401541802342820066125117927182",
            "length":  116
        },
        "id":  "CVE-2026-59186-fc5f9184",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/b1a5887372772d79328f4eb42b7f86352a38170b",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "Array2D"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "282242058557886710654782101866980497198",
            "length":  74
        },
        "id":  "CVE-2026-59186-ff89fdc2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/academysoftwarefoundation/openexr/commit/904141d3a1f86327ad1e2b93fc92ce2dd5881d34",
        "target":  {
            "file":  "src/lib/OpenEXR/ImfArray.h",
            "function":  "Array"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:18:10Z"