Bug 2537139

Summary:	CVE-2026-59982 usd: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Vladimir Vasilev <vvasilev>
Component:	usd	Assignee:	Luya Tshimbalanga <luya_tfz>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	adriacabellocrespo, ali.koroglu, code, luya_tfz, multimedia-sig, negativo17
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["c3ec1200-9213-46a2-b84b-00bdb660e4b6"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2523708

Description Vladimir Vasilev 2026-09-19 11:19:26 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Comment 1 Ben Beasley 2026-09-19 21:40:53 UTC

I’ve tried backporting some fixes from OpenEXR upstream in the past, but the CVE’s keep piling up, and downstream backporting of dozens of patches is not sustainable. The vendored OpenEXR has been updated upstream in https://github.com/PixarAnimationStudios/OpenUSD/commit/8ca068a2d06ef84a534776ac7b97973e00f6be7a, fixing dozens of CVE’s. This change isn’t a good candidate for backporting, but it should be present in the next upstream release, which will be ABI-incompatibile and therefore won’t be shipped in stable releases.