Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AcademySoftwareFoundation | openexr | >= 2.3.0, < 3.2.6, >= 3.3.0, < 3.3.8, >= 3.4.0, < 3.4.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openexr | 3.4.6+ds-1 | — |
| Debian 13 | openexr | 3.2.12-1~deb13u1 | — |
| Debian 12 | openexr | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | openexr | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | openexr | 3.1.13-2ubuntu0.26.04.1~esm1 | USN-8259-1 |
| Ubuntu Pro 24.04 LTS | openexr | 3.1.5-5.1ubuntu0.1~esm1 | USN-8259-1 |
| Ubuntu Pro 22.04 LTS | openexr | 2.5.7-1ubuntu0.1~esm2 | USN-8259-1 |
| Ubuntu Pro 20.04 LTS | openexr | 2.3.0-6ubuntu0.5+esm2 | USN-8259-1 |
| Ubuntu Pro 18.04 LTS | openexr | 2.2.0-11.1ubuntu1.9+esm1 | USN-8259-1 |
| Ubuntu Pro 16.04 LTS | openexr | 2.2.0-10ubuntu2.6+esm4 | USN-8259-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | openexr +2 | 3.1.10-8.el10_1.1 | RHSA-2026:7682 |
| RHEL 9 | openexr +2 | 3.1.1-3.el9_7.1 | RHSA-2026:8888 |
| RHEL 8 | OpenEXR +2 | 2.2.0-12.el8_10.1 | RHSA-2026:8863 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | openexr +1 | 3.1.10-8.el10_0.1 | RHSA-2026:7678 |
| RHEL 9.6 EUS | openexr +2 | 3.1.1-3.el9_6.1 | RHSA-2026:8872 |
| RHEL 9.4 EUS | openexr +2 | 3.1.1-2.el9_4.2 | RHSA-2026:8871 |
| RHEL 9.2 E4S | openexr +1 | 3.1.1-2.el9_2.2 | RHSA-2026:8869 |
| RHEL 9.0 E4S | openexr +1 | 3.1.1-2.el9_0.2 | RHSA-2026:8870 |
| RHEL 8.8 TUS | OpenEXR +1 | 2.2.0-12.el8_8.1 | RHSA-2026:12338 |
| RHEL 8.8 E4S | OpenEXR +1 | 2.2.0-12.el8_8.1 | RHSA-2026:12338 |
| RHEL 8.6 TUS | OpenEXR +1 | 2.2.0-12.el8_6.1 | RHSA-2026:12339 |
| RHEL 8.6 E4S | OpenEXR +1 | 2.2.0-12.el8_6.1 | RHSA-2026:12339 |
| RHEL 8.6 AUS | OpenEXR +1 | 2.2.0-12.el8_6.1 | RHSA-2026:12339 |
| RHEL 8.4 EUS Long Life | OpenEXR +1 | 2.2.0-12.el8_4.1 | RHSA-2026:12341 |
| RHEL 8.4 AUS | OpenEXR +1 | 2.2.0-12.el8_4.1 | RHSA-2026:12341 |
| RHEL 8.2 AUS | OpenEXR +1 | 2.2.0-11.el8_2.1 | RHSA-2026:12340 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | openexr +2 | 3.1.10-8.el10_1.1 | ALSA-2026:7682 |
| AlmaLinux 9 | openexr +2 | 3.1.1-3.el9_7.1 | ALSA-2026:8888 |
| AlmaLinux 8 | OpenEXR-libs +1 | 2.2.0-12.el8_10.1 | ALSA-2026:8863 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | openexr | 3.1.10-8.el10_1.1 | RLSA-2026:7682 |
| Rocky Linux 9 | openexr | 3.1.1-3.el9_7.1 | RLSA-2026:8888 |
| Rocky Linux 8 | OpenEXR | 2.2.0-12.el8_10.1 | RLSA-2026:8863 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | openexr | 3.2.2-160000.5.1 | SUSE-SU-2026:20936-1 |
| SLES 16.0 | openexr | 3.2.2-160000.5.1 | SUSE-SU-2026:20936-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openexr | 3.4.6-1.1 | openSUSE-SU-2026:10303-1 |
| openSUSE Leap 16.0 | openexr | 3.2.2-160000.5.1 | openSUSE-SU-2026:20433-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | openexr +2 | 3.1.5-1.amzn2023.0.7 | ALAS2023-2026-1481 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | openexr +2 | 3.1.10-8.el10_1.1 | ELSA-2026-7682 |
| Oracle Linux 9 | openexr +2 | 3.1.1-3.el9_7.1 | ELSA-2026-8888 |
| Oracle Linux 8 | OpenEXR-libs +1 | 2.2.0-12.el8_10.1 | ELSA-2026-8863 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openexr | >= 2.3.0, < 3.2.6 | 3.2.6 | GHSA-cr4v-6jm6-4963 |
| PyPI | openexr | >= 3.3.0, < 3.3.8 | 3.3.8 | GHSA-cr4v-6jm6-4963 |
| PyPI | openexr | >= 3.4.0, < 3.4.6 | 3.4.6 | GHSA-cr4v-6jm6-4963 |
| PyPI | openexr | >= 2.3.0, < 3.2.6 · >= 3.3.0, < 3.3.8 · >= 3.4.0, < 3.4.6 | 3.2.6, 3.3.8, 3.4.6 | PYSEC-2026-2846 |
Advisories 27
- WID-SEC-2026-1053 Red Hat Enterprise Linux (openexr): Schwachstelle ermöglicht Codeausführung und Dos BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:7682 Important: openexr security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:8888 Important: openexr security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:8863 Important: OpenEXR security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-8259-1 openexr vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- RHSA-2026:8888 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:8872 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:8871 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:8869 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:8870 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:8863 Red Hat Security Advisory: OpenEXR security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:7682 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:7678 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:12340 Red Hat Security Advisory: OpenEXR security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:12341 Red Hat Security Advisory: OpenEXR security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:12338 Red Hat Security Advisory: OpenEXR security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:12339 Red Hat Security Advisory: OpenEXR security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RLSA-2026:8863 Important: OpenEXR security update Rocky Linux Security Advisories · Apr 23, 2026
- RLSA-2026:8888 Important: openexr security update Rocky Linux Security Advisories · Apr 21, 2026
- ELSA-2026-8888 Important: openexr security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 20, 2026
- ELSA-2026-8863 Important: OpenEXR security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 20, 2026
- RLSA-2026:7682 Important: openexr security update Rocky Linux Security Advisories · Apr 16, 2026
- ELSA-2026-7682 Important: openexr security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Apr 13, 2026
- openSUSE-SU-2026:20433-1 Security update for openexr SUSE / openSUSE Security Updates · Apr 3, 2026
- SUSE-SU-2026:20936-1 Security update for openexr SUSE / openSUSE Security Updates · Apr 2, 2026
- ALAS2023-2026-1481 Important: openexr security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 27, 2026
- openSUSE-SU-2026:10303-1 libIex-3_4-33-3.4.6-1.1 on GA media SUSE / openSUSE Security Updates · Mar 8, 2026