{"id":"AZL-97643","summary":"CVE-2026-59186 affecting package OpenEXR 2.3.0-6","details":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 tile size. On ILP32, the Array2D\u003cRgba\u003e tile-conversion buffer size calculation overflows, allocates a much smaller heap buffer, and tile decode writes past that allocation. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","modified":"2026-08-29T05:25:22Z","published":"2026-08-25T17:17:36Z","upstream":["CVE-2026-59186"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59186"}],"affected":[{"package":{"name":"OpenEXR","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/OpenEXR"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.0-6"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97643.json"}}],"schema_version":"1.9.0"}