Skip to content
OpenAdvisories
High RHSA-2026:82345 5 CVEs

Red Hat Security Advisory: OpenEXR security update

Published Oct 14, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream OpenEXR 0:2.2.0-12.el8_10.3
Red Hat · RHEL 8 enterprise_linux:8::appstream OpenEXR-debuginfo 0:2.2.0-12.el8_10.3
Red Hat · RHEL 8 enterprise_linux:8::appstream OpenEXR-debugsource 0:2.2.0-12.el8_10.3
Red Hat · RHEL 8 enterprise_linux:8::appstream OpenEXR-libs 0:2.2.0-12.el8_10.3
Red Hat · RHEL 8 enterprise_linux:8::appstream OpenEXR-libs-debuginfo 0:2.2.0-12.el8_10.3
Red Hat · RHEL 8 enterprise_linux:8::crb OpenEXR-debuginfo 0:2.2.0-12.el8_10.3
Red Hat · RHEL 8 enterprise_linux:8::crb OpenEXR-debugsource 0:2.2.0-12.el8_10.3
Red Hat · RHEL 8 enterprise_linux:8::crb OpenEXR-devel 0:2.2.0-12.el8_10.3
Red Hat · RHEL 8 enterprise_linux:8::crb OpenEXR-libs-debuginfo 0:2.2.0-12.el8_10.3

Vulnerabilities 5

  • High 7.1
    CVE-2026-59184

    OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write

    OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make Ty…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-59186

    OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds

    OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds wri…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-59189

    OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin

    OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel<T>::row() API can retur…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-59981

    OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow

    OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds p…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-68515

    OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union

    OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it co…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2523654
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2523655
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2523671
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2523747
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2523752
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82345.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-59184
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59184
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59184
  • article
    https://github.com/AcademySoftwareFoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1
  • article
    https://github.com/AcademySoftwareFoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c
  • article
    https://github.com/AcademySoftwareFoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec
  • article
    https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-pqp9-558c-453q
  • report
    https://access.redhat.com/security/cve/CVE-2026-59186
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59186
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59186
  • article
    https://github.com/AcademySoftwareFoundation/openexr/commit/71907b44ce9a1b05bf3934b8a7821752750731ab
  • article
    https://github.com/AcademySoftwareFoundation/openexr/commit/904141d3a1f86327ad1e2b93fc92ce2dd5881d34
  • article
    https://github.com/AcademySoftwareFoundation/openexr/commit/b1a5887372772d79328f4eb42b7f86352a38170b
  • article
    https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-f667-c4wm-c8gq
  • report
    https://access.redhat.com/security/cve/CVE-2026-59189
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59189
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59189
  • article
    https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-hwmv-39v6-739m
  • report
    https://access.redhat.com/security/cve/CVE-2026-59981
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59981
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59981
  • article
    https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m799-ffc3-8pxc
  • report
    https://access.redhat.com/security/cve/CVE-2026-68515
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68515
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68515
  • article
    https://github.com/AcademySoftwareFoundation/openexr/commit/77ee19c021398b1c56f32c3af8347e365dbd4f33
  • article
    https://github.com/AcademySoftwareFoundation/openexr/commit/c644ac2dfeac82939c81a8551d6f4b7859f63add
  • article
    https://github.com/AcademySoftwareFoundation/openexr/commit/e2300a3d54a93d20a36a86b82f3a506c4c91476f
  • article
    https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-gjf7-wjjw-xq56