Skip to content
OpenAdvisories
High USN-8259-1 3 CVEs

openexr vulnerabilities

Published May 7, 2026 · Updated Oct 27, 2026

Ecosystem: Ubuntu

Summary

Quang Luong discovered that OpenEXR incorrectly handled sample count
accumulation when processing deep scan line image files. An attacker could
possibly use this issue to cause OpenEXR to crash, resulting in a denial of
service, or execute arbitrary code. (CVE-2026-27622)

It was discovered that OpenEXR had an integer overflow in the PXR24
decoder. An attacker could possibly use this issue to cause OpenEXR to
crash, resulting in a denial of service, or execute arbitrary code.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-34380)

Quang Luong discovered that OpenEXR had a signed integer overflow in the
PIZ decoder. An attacker could possibly use this issue to cause OpenEXR to
crash, resulting in a denial of service, or execute arbitrary code. This
issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-34588)

Fixed packages 6

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS openexr 2.2.0-10ubuntu2.6+esm4
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS openexr 2.2.0-11.1ubuntu1.9+esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS openexr 2.3.0-6ubuntu0.5+esm2
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS openexr 2.5.7-1ubuntu0.1~esm2
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS openexr 3.1.5-5.1ubuntu0.1~esm1
Ubuntu · Pro 26.04 LTS Pro:26.04:LTS openexr 3.1.13-2ubuntu0.26.04.1~esm1

Vulnerabilities 3

  • High 8.6
    CVE-2026-34588

    OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with si…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Alpine PyPI
  • High 8.4
    CVE-2026-27622

    OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for att…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu PyPI
  • Medium 5.9
    CVE-2026-34380

    OpenEXR has a signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a signed integer overflow exists in undo_pxr24_impl() in src/lib/Ope…

    Academy Software Foundation openexr openexr openexr Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-27622
  • report
    https://ubuntu.com/security/CVE-2026-34380
  • report
    https://ubuntu.com/security/CVE-2026-34588