OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 tile size. On ILP32, the Array2D<Rgba> tile-conversion buffer size calculation overflows, allocates a much smaller heap buffer, and tile decode writes past that allocation. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the
    motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a
    crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the
    public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 tile size. On
    ILP32, the Array2D<Rgba> tile-conversion buffer size calculation overflows, allocates a much smaller heap
    buffer, and tile decode writes past that allocation. This issue is fixed in versions 3.2.11, 3.3.13, and
    3.4.14. (CVE-2026-59186)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4003-1 advisory.

    - CVE-2026-59184: invalid heap pointer, causing out-of-bounds or use-after-free writes (bsc#1276849).
    - CVE-2026-59186: On ILP32, the Array2D<Rgba> tile-conversion buffer size calculation overflows, allocates     a much       smaller heap buffer, and tile decode writes past that allocation (bsc#1276850).
    - CVE-2026-59189: API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow     origin, resulting       in a heap out-of-bounds read and crash, with potential information disclosure under a controlled heap     layout       (bsc#1276855).
    - CVE-2026-59981: an attacker-controlled deep EXR file can access sample counts through row() performs an     out-of-bounds       read, which can crash the process or, under a controlled heap layout, return adjacent heap memory as     sample-count       values (bsc#1276862).
    - CVE-2026-59982: an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a     nonzero       dataWindow origin (bsc#1276853).
    - CVE-2026-61555: crashing occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an     empty multiView       header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name     (bsc#1276859).
    - CVE-2026-68515: The utility allocates sampled channel storage using a truncated union_width / xSampling,     then reads       the sampled input through a Slice based on the misaligned union window, producing a heap out-of-bounds     write       (bsc#1276848).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4005-1 advisory.

    - CVE-2026-59186: On ILP32, the Array2D<Rgba> tile-conversion buffer size calculation overflows, allocates     a much       smaller heap buffer, and tile decode writes past that allocation (bsc#1276850).
    - CVE-2026-61555: crashing occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an     empty multiView       header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name     (bsc#1276859).
    - CVE-2026-68515: The utility allocates sampled channel storage using a truncated union_width / xSampling,     then reads       the sampled input through a Slice based on the misaligned union window, producing a heap out-of-bounds     write       (bsc#1276848).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the     motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a     crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the     public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 tile size. On     ILP32, the Array2D<Rgba> tile-conversion buffer size calculation overflows, allocates a much smaller heap     buffer, and tile decode writes past that allocation. This issue is fixed in versions 3.2.11, 3.3.13, and     3.4.14. (CVE-2026-59186)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 56449320-97c5-11f1-84d7-3c7c3fba4204 advisory.

    Cary Phillips reports:
    [The OpenEXR 3.4.14] release addresses the following security vulnerabilities:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
465208	Echo: openexr: security update to 3.1.13-2+e4	Tenable Cloud Security	Echo Local Security Checks	Local	high
465208	Echo: openexr: security update to 3.1.13-2+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
348450	SUSE SLED15 / SLES15 Security Update : openexr (SUSE-SU-2026:4003-1)	Nessus	SuSE Local Security Checks	Local	high
348449	SUSE SLES12 Security Update : openexr (SUSE-SU-2026:4005-1)	Nessus	SuSE Local Security Checks	Local	high
341337	Linux Distros Unpatched Vulnerability : CVE-2026-59186	Nessus	Misc.	Local	high
335504	FreeBSD : OpenEXR -- 3.4.14 fixes multiple vulnerabilities (56449320-97c5-11f1-84d7-3c7c3fba4204)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2026-59186

high

Tenable Plugins

high

high

high

high

high

high