Skip to content
OpenAdvisories
Medium ALAS2023-2026-1561 1 CVE

Moderate: openexr security update (Amazon Linux 2023)

Published Apr 13, 2026 · Updated Apr 13, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34544: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, a crafted B44 or B44A EXR file can cause an out-of-bounds write in any application that decodes it via exr_decoding_run(). Consequences range from immediate crash (most likely) to corruption of adjacent heap allocations (layout-dependent). This issue has been patched in version 3.4.8.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2023 openexr 0:3.1.5-1.amzn2023.0.8
Amazon Linux · 2023 openexr-debuginfo 0:3.1.5-1.amzn2023.0.8
Amazon Linux · 2023 openexr-debugsource 0:3.1.5-1.amzn2023.0.8
Amazon Linux · 2023 openexr-devel 0:3.1.5-1.amzn2023.0.8
Amazon Linux · 2023 openexr-libs 0:3.1.5-1.amzn2023.0.8
Amazon Linux · 2023 openexr-libs-debuginfo 0:3.1.5-1.amzn2023.0.8

Vulnerabilities 1

  • High 8.4
    CVE-2026-34544

    OpenEXR: integer overflow to OOB write in uncompress_b44_impl()

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, a crafted B44 or B44A EXR file can cause an out-of-bounds write in any…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Alpine Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-34544.html