Nixpkgs security tracker

Untriaged

Permalink CVE-2026-59184

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

created 4 days, 6 hours ago Activity log

Created suggestion 4 days, 6 hours ago

OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application writes rows through FlatHalfChannel::row(). Affected consumers are tools, converters, render pipeline components, or image-processing services that accept untrusted EXR files and use FlatHalfChannel::row() on loaded images. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

References

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-pqp9-558c-453q x_refsource_CONFIRM
https://github.com/AcademySoftwareFoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1 x_refsource_MISC
https://github.com/AcademySoftwareFoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c x_refsource_MISC
https://github.com/AcademySoftwareFoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec x_refsource_MISC

Affected products

openexr

==>= 3.4.0, < 3.4.14
==< 3.2.11
==>= 3.3.0, < 3.3.13

Matching in nixpkgs

pkgs.openexr

High dynamic-range (HDR) image file format

nixos-unstable 3.4.10
- nixpkgs-unstable 3.4.11
- nixos-unstable-small 3.4.13
nixos-26.05 3.4.11
- nixos-26.05-small 3.4.11
- nixpkgs-26.05-darwin 3.4.11

pkgs.openexr_2

High dynamic-range (HDR) image file format

nixos-unstable 2.5.10
- nixpkgs-unstable 2.5.10
- nixos-unstable-small 2.5.10
nixos-26.05 2.5.10
- nixos-26.05-small 2.5.10
- nixpkgs-26.05-darwin 2.5.10

pkgs.openexrid-unstable

OpenEXR files able to isolate any object of a CG image with a perfect antialiazing

nixos-unstable 2017-09-17
- nixpkgs-unstable 2017-09-17
- nixos-unstable-small 2017-09-17
nixos-26.05 2017-09-17
- nixos-26.05-small 2017-09-17
- nixpkgs-26.05-darwin 2017-09-17

pkgs.haskellPackages.openexr-write

Library for writing images in OpenEXR HDR file format

nixos-unstable 0.1.0.2
- nixpkgs-unstable 0.1.0.2
- nixos-unstable-small 0.1.0.2
nixos-26.05 0.1.0.2
- nixos-26.05-small 0.1.0.2
- nixpkgs-26.05-darwin 0.1.0.2

Package maintainers

@paperdigits Mica Semrick <mica@silentumbrella.com>
@guibou Guillaume Bouchard <guillaum.bouchard@gmail.com>

Suggestion detail