Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, a crafted B44 or B44A EXR file can cause an out-of-bounds write in any application that decodes it via exr_decoding_run(). Consequences range from immediate crash (most likely) to corruption of adjacent heap allocations (layout-dependent). This issue has been patched in version 3.4.8.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.4.0, < 3.4.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openexr | 3.4.14-0.1 | — |
| Debian 13 | openexr | 3.2.12-1~deb13u1 | — |
| Debian 12 | openexr | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | openexr | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | openexr +2 | 3.1.10-8.el10_2.5 | RHSA-2026:84796 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | openexr +2 | 3.1.10-8.el10_2.5 | ALSA-2026:84796 |
| AlmaLinux 9 | openexr-devel | 3.1.1-3.el9_8.5 | ALSA-2026:86983 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | openexr | 3.1.10-8.el10_2.5 | RLSA-2026:98575, RLSA-2026:84796 |
| Rocky Linux 10 | openexr-libs +1 | 3.1.10-12.el10_3.2 | RLSA-2026:98575 |
| Rocky Linux 9 | openexr | 3.1.1-3.el9_8.5 | RLSA-2026:98471, RLSA-2026:86983 |
| Rocky Linux 9 | openexr-libs +1 | 3.1.1-6.el9_9.2 | RLSA-2026:98471 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openexr | 3.4.9-1.1 | openSUSE-SU-2026:10505-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openexr | 3.4.10-r0 | — |
| Alpine v3.23 | openexr | 3.4.13-r0 | — |
| Alpine v3.22 | openexr | 3.3.11-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | openexr +2 | 3.1.5-1.amzn2023.0.8 | ALAS2023-2026-1561 |
| Amazon Linux 2 | OpenEXR +2 | 1.7.1-8.amzn2.0.5 | ALAS2-2026-3267 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | openexr +2 | 3.1.10-8.el10_2.5 | ELSA-2026-84796 |
| Oracle Linux 9 | openexr +2 | 3.1.1-3.el9_8.5 | ELSA-2026-86983 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | openexr +7 | 3.4.9-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openexr | >= 3.4.0, < 3.4.8 | 3.4.8 | GHSA-h762-rhv3-h25v |
| PyPI | openexr | >= 3.3.0, <= 3.3.8 | — | GHSA-h762-rhv3-h25v |
| PyPI | openexr | >= 3.2.0, <= 3.2.6 | — | GHSA-h762-rhv3-h25v |
| PyPI | openexr | >= 3.2.0, < 3.4.8 | 3.4.8 | PYSEC-2026-2847 |
Advisories 12
- RLSA-2026:98575 Important: openexr security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:98471 Important: openexr security update Rocky Linux Security Advisories · Nov 13, 2026
- ALSA-2026:86983 Important: openexr security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:84796 Important: openexr security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:86983 Important: openexr security update Rocky Linux Security Advisories · Oct 22, 2026
- ELSA-2026-86983 Important: openexr security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
- RLSA-2026:84796 Important: openexr security update Rocky Linux Security Advisories · Oct 20, 2026
- RHSA-2026:84796 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ELSA-2026-84796 Important: openexr security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 19, 2026
- ALAS2-2026-3267 Important: OpenEXR security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 29, 2026
- ALAS2023-2026-1561 Moderate: openexr security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 13, 2026
- openSUSE-SU-2026:10505-1 libIex-3_4-33-3.4.9-1.1 on GA media SUSE / openSUSE Security Updates · Apr 9, 2026