Skip to content
OpenAdvisories
High RHSA-2026:38499 2 CVEs

Red Hat Security Advisory: openexr security update

Published Jul 13, 2026 · Updated Oct 14, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 openexr 0:3.1.10-8.el10_2.3
Red Hat · RHEL 10 enterprise_linux:10.2 openexr-debuginfo 0:3.1.10-8.el10_2.3
Red Hat · RHEL 10 enterprise_linux:10.2 openexr-debugsource 0:3.1.10-8.el10_2.3
Red Hat · RHEL 10 enterprise_linux:10.2 openexr-devel 0:3.1.10-8.el10_2.3
Red Hat · RHEL 10 enterprise_linux:10.2 openexr-libs 0:3.1.10-8.el10_2.3
Red Hat · RHEL 10 enterprise_linux:10.2 openexr-libs-debuginfo 0:3.1.10-8.el10_2.3

Vulnerabilities 2

  • High 8.8
    CVE-2026-41142

    OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overf…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Alpine Wolfi
  • High 8.8
    CVE-2026-42216

    OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() recons…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467623
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467633
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38499.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-41142
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41142
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41142
  • article
    https://github.com/AcademySoftwareFoundation/openexr/commit/0592ee539f33c122c90f09238579b902d838afb4
  • article
    https://github.com/AcademySoftwareFoundation/openexr/pull/2367
  • article
    https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m25w-72cj-q6mg
  • report
    https://access.redhat.com/security/cve/CVE-2026-42216
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42216
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42216
  • article
    https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-65j8-95g9-jgj4