Skip to content
OpenAdvisories
High ELSA-2026-38499 2 CVEs

Important: openexr security update (Oracle Linux 10)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[3.1.10-8.3]
- fix CVE-2026-41142
- fix CVE-2026-42216

[3.1.10-8.2]
- fix CVE-2026-34588

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 10 openexr 0:3.1.10-8.el10_2.3
Oracle Linux · 10 openexr-devel 0:3.1.10-8.el10_2.3
Oracle Linux · 10 openexr-libs 0:3.1.10-8.el10_2.3

Vulnerabilities 2

  • High 8.8
    CVE-2026-41142

    OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overf…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Alpine Wolfi
  • High 8.8
    CVE-2026-42216

    OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() recons…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Alpine Wolfi