Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.1.0, <= 3.1.13, >= 3.2.0, < 3.2.7, >= 3.3.0, < 3.3.9, >= 3.4.0, < 3.4.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openexr | 3.4.14-0.1 | — |
| Debian 13 | openexr | 3.2.12-1~deb13u1 | — |
| Debian 12 | openexr | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | openexr | No fix yet | — |
| Ubuntu 25.10 | openexr | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | openexr | 3.1.13-2ubuntu0.26.04.1~esm1 | USN-8259-1 |
| Ubuntu Pro 24.04 LTS | openexr | 3.1.5-5.1ubuntu0.1~esm1 | USN-8259-1 |
| Ubuntu Pro 22.04 LTS | openexr | 2.5.7-1ubuntu0.1~esm2 | USN-8259-1 |
| Ubuntu Pro 20.04 LTS | openexr | 2.3.0-6ubuntu0.5+esm2 | USN-8259-1 |
| Ubuntu Pro 18.04 LTS | openexr | 2.2.0-11.1ubuntu1.9+esm1 | USN-8259-1 |
| Ubuntu Pro 16.04 LTS | openexr | 2.2.0-10ubuntu2.6+esm4 | USN-8259-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | openexr +2 | 3.1.10-8.el10_1.2 | RHSA-2026:19146, RHSA-2026:15888 |
| RHEL 9 | openexr +2 | 3.1.1-3.el9_7.2 | RHSA-2026:19359, RHSA-2026:15887 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | openexr +2 | 3.1.10-8.el10_0.2 | RHSA-2026:17656 |
| RHEL 9.6 EUS | openexr +2 | 3.1.1-3.el9_6.2 | RHSA-2026:17660 |
| RHEL 9.4 EUS | openexr +2 | 3.1.1-2.el9_4.3 | RHSA-2026:17658 |
| RHEL 9.2 E4S | openexr +1 | 3.1.1-2.el9_2.3 | RHSA-2026:17659 |
| RHEL 9.0 E4S | openexr +1 | 3.1.1-2.el9_0.3 | RHSA-2026:19587 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | openexr +2 | 3.1.10-8.el10_1.2 | ALSA-2026:19146, ALSA-2026:15888 |
| AlmaLinux 9 | openexr +2 | 3.1.1-3.el9_7.2 | ALSA-2026:19359, ALSA-2026:15887 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | openexr | 3.1.10-8.el10_1.2 | RLSA-2026:19146, RLSA-2026:15888 |
| Rocky Linux 9 | openexr | 3.1.1-3.el9_7.2 | RLSA-2026:19359, RLSA-2026:15887 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openexr | 3.4.9-1.1 | openSUSE-SU-2026:10505-1 |
| openSUSE Leap 16.0 | openexr | 3.2.2-160000.6.1 | openSUSE-SU-2026:20605-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openexr | 3.4.10-r0 | — |
| Alpine v3.23 | openexr | 3.4.13-r0 | — |
| Alpine v3.22 | openexr | 3.3.11-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | openexr +2 | 3.1.5-1.amzn2023.0.9 | ALAS2023-2026-1612 |
| Amazon Linux 2 | OpenEXR +2 | 1.7.1-8.amzn2.0.5 | ALAS2-2026-3267 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | openexr +2 | 3.1.10-8.el10_1.2 | ELSA-2026-19146, ELSA-2026-15888 |
| Oracle Linux 9 | openexr +2 | 3.1.1-3.el9_7.2 | ELSA-2026-19359, ELSA-2026-15887 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openexr | >= 3.1.0, < 3.2.7 | 3.2.7 | GHSA-588r-cr5c-w6hf |
| PyPI | openexr | >= 3.3.0, < 3.3.9 | 3.3.9 | GHSA-588r-cr5c-w6hf |
| PyPI | openexr | >= 3.4.0, < 3.4.9 | 3.4.9 | GHSA-588r-cr5c-w6hf |
| PyPI | openexr | >= 3.1.0, < 3.2.7 · >= 3.3.0, < 3.3.9 · >= 3.4.0, < 3.4.9 | 3.2.7, 3.3.9, 3.4.9 | PYSEC-2026-2845 |
Advisories 27
- WID-SEC-2026-1440 Red Hat Enterprise Linux (openEXR): Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:15888 Important: openexr security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19359 Important: openexr security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:15887 Important: openexr security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19146 Important: openexr security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-8259-1 openexr vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- RHSA-2026:19587 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:19359 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:19146 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:17660 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:17659 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:17656 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:17658 Red Hat Security Advisory: openexr update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:15888 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- RHSA-2026:15887 Red Hat Security Advisory: openexr security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- ELSA-2026-19146 Important: openexr security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 21, 2026
- ELSA-2026-19359 Important: openexr security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- RLSA-2026:19146 Important: openexr security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:19359 Important: openexr security update Rocky Linux Security Advisories · May 20, 2026
- RLSA-2026:15888 Important: openexr security update Rocky Linux Security Advisories · May 13, 2026
- RLSA-2026:15887 Important: openexr security update Rocky Linux Security Advisories · May 13, 2026
- ELSA-2026-15888 Important: openexr security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · May 11, 2026
- ELSA-2026-15887 Important: openexr security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 11, 2026
- ALAS2023-2026-1612 Important: openexr security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
- ALAS2-2026-3267 Important: OpenEXR security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 29, 2026
- openSUSE-SU-2026:20605-1 Security update for openexr SUSE / openSUSE Security Updates · Apr 24, 2026
- openSUSE-SU-2026:10505-1 libIex-3_4-33-3.4.9-1.1 on GA media SUSE / openSUSE Security Updates · Apr 9, 2026
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.7
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.9
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9