Skip to content
OpenAdvisories
High RHSA-2026:17658 1 CVE

Red Hat Security Advisory: openexr update

Published May 15, 2026 · Updated Oct 3, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream openexr 0:3.1.1-2.el9_4.3
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream openexr-debuginfo 0:3.1.1-2.el9_4.3
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream openexr-debugsource 0:3.1.1-2.el9_4.3
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream openexr-libs 0:3.1.1-2.el9_4.3
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream openexr-libs-debuginfo 0:3.1.1-2.el9_4.3
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb openexr-debuginfo 0:3.1.1-2.el9_4.3
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb openexr-debugsource 0:3.1.1-2.el9_4.3
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb openexr-devel 0:3.1.1-2.el9_4.3
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb openexr-libs-debuginfo 0:3.1.1-2.el9_4.3

Vulnerabilities 1

  • High 8.6
    CVE-2026-34588

    OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with si…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455408
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17658.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-34588
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34588
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34588
  • article
    https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf