Skip to content
OpenAdvisories
High RHSA-2026:17656 1 CVE

Red Hat Security Advisory: openexr security update

Published May 15, 2026 · Updated Oct 3, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 openexr 0:3.1.10-8.el10_0.2
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 openexr-debuginfo 0:3.1.10-8.el10_0.2
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 openexr-debugsource 0:3.1.10-8.el10_0.2
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 openexr-devel 0:3.1.10-8.el10_0.2
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 openexr-libs 0:3.1.10-8.el10_0.2
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 openexr-libs-debuginfo 0:3.1.10-8.el10_0.2

Vulnerabilities 1

  • High 8.6
    CVE-2026-34588

    OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with si…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455408
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17656.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-34588
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34588
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34588
  • article
    https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf