CVE-2026-59981 affects the OpenEXR library, the reference implementation for the EXR image format used in the motion picture industry. The vulnerability exists in the OpenEXRUtil library's SampleCountChannel::row() API, which returns an out-of-bounds pointer when processing deep images with a non-zero dataWindow origin. The conflict between 0-based row indexing and absolute pixel coordinate offsets causes row(0) to point far outside the allocated sample-count buffer when the data window has a large negative vertical origin. An attacker can craft a malicious deep EXR file that, when opened by a vulnerable application, triggers an out-of-bounds read. This can result in process crashes or, under a controlled heap layout, exposure of adjacent heap memory contents. Affected versions include through 3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. Fixes are available in versions 3.2.11, 3.3.13, and 3.4.14.
