CVE-2026-110597 Details
Description
Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute() bounds checks, crashing applications or leaking adjacent heap memory into attribute values.
A heap out-of-bounds read vulnerability has been identified in Tinyexr versions through 3.2.0, specifically in the function ParseEXRMultipartHeaderFromMemory(). This vulnerability allows attackers to read beyond allocated buffers by exploiting a stale remaining-size value. By supplying a crafted multi-part EXR file, attackers can manipulate headers in a way that bypasses proper bounds checks, leading to application crashes or unauthorized leakage of adjacent heap memory into attribute values.
The vulnerability can be fixed by updating the ParseEXRMultipartHeaderFromMemory function to correctly track the remaining bytes for each part header. This involves adjusting the length passed to the ReadAttribute function to ensure it reflects the actual available data, preventing the out-of-bounds read.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tinyexr | <= 3.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |