CVE-2026-59189
- Source
- https://cve.org/CVERecord?id=CVE-2026-59189
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59189.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-59189
- Aliases
-
- GHSA-hwmv-39v6-739m
- Downstream
- Related
- Published
- 2026-08-25T16:51:31.110Z
- Modified
- 2026-08-27T19:34:10.603212Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVSS Calculator
- Summary
- OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin
- Details
-
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel<T>::row() API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin, resulting in a heap out-of-bounds read and crash, with potential information disclosure under a controlled heap layout. The flaw arises because ImfDeepImageChannel uses two conflicting coordinate models: at(x, y) uses absolute coordinates (with _base offset by dataWindow.min), while row(r) is documented as 0-based logical access. For a non-zero dataWindow.min, row(0) therefore points outside the _sampleListPointers allocation instead of at the first logical row. This issue is fixed in versions 3.3.13 and 3.4.13.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59189.json", "cwe_ids": [ "CWE-125" ], "cna_assigner": "GitHub_M" }- References
-
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-hwmv-39v6-739m
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59189.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-59189
- https://github.com/AcademySoftwareFoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1
- https://github.com/AcademySoftwareFoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c
- https://github.com/AcademySoftwareFoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec
Affected packages
Git / github.com/academysoftwarefoundation/openexr
Affected ranges
- Type
- GIT
- Repo
- https://github.com/academysoftwarefoundation/openexr
- Events
-
IntroducedFixedIntroducedFixedFixedFixedFixed
- Database specific
-
Show details
{ "source": [ "DESCRIPTION", "REFERENCES" ], "extracted_events": [ { "introduced": "3.3.0" }, { "fixed": "3.3.12" }, { "introduced": "3.4.0" }, { "fixed": "3.4.12" } ] }
Affected versions
v3.*
v3.3.0
v3.3.0-rc2
v3.3.1
v3.3.1-rc
v3.3.10
v3.3.10-rc
v3.3.10-rc2
v3.3.11
v3.3.11-rc3
v3.3.12
v3.3.12-rc
v3.3.2
v3.3.2-rc
v3.3.2-rc2
v3.3.2-rc3
v3.3.2-rc4
v3.3.3
v3.3.3-rc
v3.3.3-rc1
v3.3.4
v3.3.4-rc
v3.3.5
v3.3.5-rc
v3.3.5-rc3
v3.3.6
v3.3.6-rc
v3.3.6-rc2
v3.3.6-rc3
v3.3.6-rc4
v3.3.7
v3.3.7-rc
v3.3.7-rc2
v3.3.7-rc3
v3.3.7-rc4
v3.3.8
v3.3.8-rc
v3.3.9
v3.3.9-rc
v3.3.9-rc2
v3.4.0
v3.4.1
v3.4.1-rc
v3.4.1-rc2
v3.4.10
v3.4.10-rc
v3.4.11
v3.4.11-rc
v3.4.11-rc2
v3.4.11-rc3
v3.4.12
v3.4.12-rc2
v3.4.13
v3.4.13-rc
v3.4.13-rc2
v3.4.13-rc3
v3.4.2
v3.4.2-rc
v3.4.2-rc2
v3.4.3
v3.4.3-rc
v3.4.3-rc2
v3.4.3-rc3
v3.4.4
v3.4.4-rc
v3.4.4-rc2
v3.4.5
v3.4.5-rc
v3.4.6
v3.4.6-rc
v3.4.7
v3.4.7-rc
v3.4.8
v3.4.8-rc
v3.4.9
v3.4.9-rc
Database specific
vanir_signatures
[
{
"id": "CVE-2026-59189-029f7024",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfFlatImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "158796205751142772897768494416029777845",
"length": 72.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-1a27d03d",
"target": {
"file": "src/lib/OpenEXRUtil/ImfDeepImageChannel.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"33088020735471794752811703951061431685",
"295620870024032927240760181809029871864",
"18812187228488125594640742038424998789",
"161132528775893895852039169535639786485",
"13857654978500129048888096659620392393",
"120073767694878138826856607156011155405",
"260664129758642251505016801450453866427",
"331184302860071834278978743063489719015",
"285166751721855665171686788274856720506",
"68168968677568436872626054001993677402"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-243fa8bb",
"target": {
"file": "src/test/OpenEXRUtilTest/testDeepImage.cpp"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"39369499439165929212425823308619691159",
"266760019383743716150584509388851496900",
"42653368493869997497314442718458143516",
"103671658102312103092147353335086631542",
"107073319122823109909174352669628305239",
"232275175117863456315395640753074673444",
"240512483478303665726891746749257419994"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-2948d9bf",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfFlatImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "110585950910128101596843041345344169165",
"length": 66.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-2a79c749",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfDeepImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "110585950910128101596843041345344169165",
"length": 66.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-2b130667",
"target": {
"file": "src/lib/OpenEXRUtil/ImfDeepImageChannel.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"33088020735471794752811703951061431685",
"295620870024032927240760181809029871864",
"18812187228488125594640742038424998789",
"161132528775893895852039169535639786485",
"13857654978500129048888096659620392393",
"120073767694878138826856607156011155405",
"260664129758642251505016801450453866427",
"331184302860071834278978743063489719015",
"285166751721855665171686788274856720506",
"68168968677568436872626054001993677402"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-33f1523a",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfDeepImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "158796205751142772897768494416029777845",
"length": 72.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-358477e2",
"target": {
"file": "src/lib/OpenEXRUtil/ImfSampleCountChannel.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"254502877786632950204708836805398063097",
"114228806546493661120860686230784564472",
"226198338003979056262324399968515474804",
"301136904542702397400972023161823894536"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-439b3ef3",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfDeepImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "158796205751142772897768494416029777845",
"length": 72.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-56d7b9d4",
"target": {
"file": "src/lib/OpenEXRUtil/ImfDeepImageChannel.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"33088020735471794752811703951061431685",
"295620870024032927240760181809029871864",
"18812187228488125594640742038424998789",
"161132528775893895852039169535639786485",
"13857654978500129048888096659620392393",
"120073767694878138826856607156011155405",
"260664129758642251505016801450453866427",
"331184302860071834278978743063489719015",
"285166751721855665171686788274856720506",
"68168968677568436872626054001993677402"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-5c388692",
"target": {
"file": "src/lib/OpenEXRUtil/ImfSampleCountChannel.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"254502877786632950204708836805398063097",
"114228806546493661120860686230784564472",
"226198338003979056262324399968515474804",
"301136904542702397400972023161823894536"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-6040ef06",
"target": {
"file": "src/lib/OpenEXRUtil/ImfFlatImageChannel.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"69030260872799709258455909920858315950",
"79627724265277323862740959468206508283",
"18812187228488125594640742038424998789",
"242912398733734525914089318487284155868",
"176075231185443607266967389174586416626",
"178298400957258287113074708337116367137",
"24661120780328304642855224802032703976",
"277232867296595662039933500404193229201",
"247908825518859004264210074910806670668",
"125277615393647158451864593506443900735"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-61895ded",
"target": {
"file": "src/lib/OpenEXRUtil/ImfFlatImageChannel.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"69030260872799709258455909920858315950",
"79627724265277323862740959468206508283",
"18812187228488125594640742038424998789",
"242912398733734525914089318487284155868",
"176075231185443607266967389174586416626",
"178298400957258287113074708337116367137",
"24661120780328304642855224802032703976",
"277232867296595662039933500404193229201",
"247908825518859004264210074910806670668",
"125277615393647158451864593506443900735"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-6b483d18",
"target": {
"function": "SampleCountChannel::row",
"file": "src/lib/OpenEXRUtil/ImfSampleCountChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "314156685687285098169350094337245807471",
"length": 119.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-6d01d8e3",
"target": {
"function": "SampleCountChannel::row",
"file": "src/lib/OpenEXRUtil/ImfSampleCountChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "314156685687285098169350094337245807471",
"length": 119.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-7cf1858a",
"target": {
"file": "src/lib/OpenEXRUtil/ImfFlatImageChannel.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"69030260872799709258455909920858315950",
"79627724265277323862740959468206508283",
"18812187228488125594640742038424998789",
"242912398733734525914089318487284155868",
"176075231185443607266967389174586416626",
"178298400957258287113074708337116367137",
"24661120780328304642855224802032703976",
"277232867296595662039933500404193229201",
"247908825518859004264210074910806670668",
"125277615393647158451864593506443900735"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-801b3656",
"target": {
"file": "src/test/OpenEXRUtilTest/testDeepImage.cpp"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"39369499439165929212425823308619691159",
"266760019383743716150584509388851496900",
"42653368493869997497314442718458143516",
"103671658102312103092147353335086631542",
"107073319122823109909174352669628305239",
"232275175117863456315395640753074673444",
"240512483478303665726891746749257419994"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-81059b4b",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfDeepImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "110585950910128101596843041345344169165",
"length": 66.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-97e56df8",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfFlatImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "158796205751142772897768494416029777845",
"length": 72.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-a2305b70",
"target": {
"function": "SampleCountChannel::row",
"file": "src/lib/OpenEXRUtil/ImfSampleCountChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "314156685687285098169350094337245807471",
"length": 119.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-aae2caac",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfFlatImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "158796205751142772897768494416029777845",
"length": 72.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-bbf865bf",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfDeepImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "110585950910128101596843041345344169165",
"length": 66.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-cd43c617",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfFlatImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "110585950910128101596843041345344169165",
"length": 66.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-ce2ca0b7",
"target": {
"function": "testDeepImage",
"file": "src/test/OpenEXRUtilTest/testDeepImage.cpp"
},
"deprecated": false,
"digest": {
"function_hash": "161641068831394744715730264042097066174",
"length": 447.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-d1912d1a",
"target": {
"function": "testDeepImage",
"file": "src/test/OpenEXRUtilTest/testDeepImage.cpp"
},
"deprecated": false,
"digest": {
"function_hash": "161641068831394744715730264042097066174",
"length": 447.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-d3ad8b7e",
"target": {
"function": "testDeepImage",
"file": "src/test/OpenEXRUtilTest/testDeepImage.cpp"
},
"deprecated": false,
"digest": {
"function_hash": "161641068831394744715730264042097066174",
"length": 447.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-d513f6a7",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfFlatImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "110585950910128101596843041345344169165",
"length": 66.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec",
"signature_type": "Function"
},
{
"id": "CVE-2026-59189-e08c2a28",
"target": {
"file": "src/test/OpenEXRUtilTest/testDeepImage.cpp"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"39369499439165929212425823308619691159",
"266760019383743716150584509388851496900",
"42653368493869997497314442718458143516",
"103671658102312103092147353335086631542",
"107073319122823109909174352669628305239",
"232275175117863456315395640753074673444",
"240512483478303665726891746749257419994"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-ebc09a22",
"target": {
"file": "src/lib/OpenEXRUtil/ImfSampleCountChannel.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"254502877786632950204708836805398063097",
"114228806546493661120860686230784564472",
"226198338003979056262324399968515474804",
"301136904542702397400972023161823894536"
]
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1",
"signature_type": "Line"
},
{
"id": "CVE-2026-59189-ff962b91",
"target": {
"function": "row",
"file": "src/lib/OpenEXRUtil/ImfDeepImageChannel.h"
},
"deprecated": false,
"digest": {
"function_hash": "158796205751142772897768494416029777845",
"length": 72.0
},
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c",
"signature_type": "Function"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59189.json"
vanir_signatures_modified
"2026-08-27T19:34:10Z"