Skip to content
OpenAdvisories
High RHSA-2026:19587 1 CVE

Red Hat Security Advisory: openexr security update

Published May 21, 2026 · Updated Oct 3, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream openexr 0:3.1.1-2.el9_0.3
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream openexr-debuginfo 0:3.1.1-2.el9_0.3
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream openexr-debugsource 0:3.1.1-2.el9_0.3
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream openexr-libs 0:3.1.1-2.el9_0.3
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream openexr-libs-debuginfo 0:3.1.1-2.el9_0.3

Vulnerabilities 1

  • High 8.6
    CVE-2026-34588

    OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with si…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455408
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19587.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-34588
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34588
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34588
  • article
    https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf