Bug 2537144

Summary: CVE-2026-59189 usd: OpenEXR: Information disclosure and denial of service due to out-of-bounds read [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: usdAssignee: Luya Tshimbalanga <luya_tfz>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: adriacabellocrespo, ali.koroglu, code, luya_tfz, multimedia-sig, negativo17
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["b2c2b382-da8a-4f2e-b847-c646e6ab03dc"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2523671    

Description Vladimir Vasilev 2026-09-19 11:27:47 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel<T>::row() API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin, resulting in a heap out-of-bounds read and crash, with potential information disclosure under a controlled heap layout. The flaw arises because ImfDeepImageChannel uses two conflicting coordinate models: at(x, y) uses absolute coordinates (with _base offset by dataWindow.min), while row(r) is documented as 0-based logical access. For a non-zero dataWindow.min, row(0) therefore points outside the _sampleListPointers allocation instead of at the first logical row. This issue is fixed in versions 3.3.13 and 3.4.13.
Comment 1 Ben Beasley 2026-09-19 21:40:33 UTC 
I’ve tried backporting some fixes from OpenEXR upstream in the past, but the CVE’s keep piling up, and downstream backporting of dozens of patches is not sustainable. The vendored OpenEXR has been updated upstream in https://github.com/PixarAnimationStudios/OpenUSD/commit/8ca068a2d06ef84a534776ac7b97973e00f6be7a, fixing dozens of CVE’s. This change isn’t a good candidate for backporting, but it should be present in the next upstream release, which will be ABI-incompatibile and therefore won’t be shipped in stable releases.