Every CVE Search/ Get API key

CVE-2024-31047

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to...

3.3 LowFix available

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.22%Up 0.2 points since Apr 9, 2024
90%50%10%1%

What each source reports

CVE List Score used 3.3

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.

Record
CVE-2024-31047
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2024-28964 3.3

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.

Record
EUVD-2024-28964
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-prq6-rh2c-gq39 3.3

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to...

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.

Record
GHSA-prq6-rh2c-gq39
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
NVD 3.3

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.

Record
CVE-2024-31047
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
OSV 3.3

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.

Record
CVE-2024-31047
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2024-31047 3.3

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.

Record
DEBIAN-CVE-2024-31047
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 9 moreShow less
OSVJLSEC-2026-134 3.3

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.

Record
JLSEC-2026-134
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2024-1549 5.5

OpenEXR security update

OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.

Security Fix(es):

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.(CVE-2024-31047)

Record
OESA-2024-1549
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1585 5.5

OpenEXR security update

OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.

Security Fix(es):

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.(CVE-2024-31047)

Record
OESA-2024-1585
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1586 5.5

OpenEXR security update

OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.

Security Fix(es):

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.(CVE-2024-31047)

Record
OESA-2024-1586
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-31047 3.3

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.

Record
UBUNTU-CVE-2024-31047
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVCLSA-2025-1759413150 No score

openexr: Fix of CVE-2024-31047

  • CVE-2024-31047: fix denial of service issue in convert function of exrmultipart.cpp
Record
CLSA-2025-1759413150
Updated
2026-11-02
OSVCLSA-2026-1788193914 No score

Fix CVE(s): CVE-2024-31047

  • SECURITY UPDATE: Integer overflow in exrmultipart conversion
    • debian/patches/CVE-2024-31047.patch: use int64_t for data window dimensions in exrmultipart/exrmultipart.cpp.
    • CVE-2024-31047
Record
CLSA-2026-1788193914
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2024-31047 No score

CVE-2024-31047 in openexr - Patched by Root

Root has patched CVE-2024-31047 in the openexr package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2024-31047
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2024-31047 No score

CVE-2024-31047 in openexr - Patched by Root

Root has patched CVE-2024-31047 in the openexr package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2024-31047
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openexr
TuxCare:AlmaLinux:9.2
 before 3.1.1-2.el9.tuxcare.els2
3.1.1-2.el9.tuxcare.els2
openexr-devel
TuxCare:AlmaLinux:9.2
 before 3.1.1-2.el9.tuxcare.els2
3.1.1-2.el9.tuxcare.els2
openexr-libs
TuxCare:AlmaLinux:9.2
 before 3.1.1-2.el9.tuxcare.els2
3.1.1-2.el9.tuxcare.els2
libopenexr-dev
TuxCare:Ubuntu:18.04
 before 2.2.0-11.1ubuntu1.9+tuxcare.els3
2.2.0-11.1ubuntu1.9+tuxcare.els3
libopenexr22
TuxCare:Ubuntu:18.04
 before 2.2.0-11.1ubuntu1.9+tuxcare.els3
2.2.0-11.1ubuntu1.9+tuxcare.els3
openexr
TuxCare:Ubuntu:18.04
 before 2.2.0-11.1ubuntu1.9+tuxcare.els3
2.2.0-11.1ubuntu1.9+tuxcare.els3
openexr-doc
TuxCare:Ubuntu:18.04
 before 2.2.0-11.1ubuntu1.9+tuxcare.els3
2.2.0-11.1ubuntu1.9+tuxcare.els3
openexr
Debian:12
 All versions, plus listed versions
3.1.13-13.1.13-23.1.5-53.1.5-5.13.1.5-5.1+hurd.1
Show 8 moreShow less
3.4.14-0.13.4.15+ds-13.4.16+ds-13.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-43.5.2+ds-1
 None known
openexr
Debian:13
 before 3.1.13-1
3.1.13-1
openexr
Debian:14
 before 3.1.13-1
3.1.13-1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
OpenEXR_jll
Julia
 before 3.2.4+0
3.2.4+0
OpenEXR
openEuler:20.03-LTS-SP1
 before 2.2.0-29.oe1
2.2.0-29.oe1
OpenEXR
openEuler:20.03-LTS-SP4
 before 2.2.0-29.oe2003sp4
2.2.0-29.oe2003sp4
OpenEXR
openEuler:22.03-LTS
 before 3.1.5-3.oe2203sp2
3.1.5-3.oe2203sp2
OpenEXR
openEuler:22.03-LTS-SP2
 before 3.1.5-3.oe2203sp2
3.1.5-3.oe2203sp2
OpenEXR
openEuler:22.03-LTS-SP1
 before 3.1.5-3.oe2203sp1
3.1.5-3.oe2203sp1
OpenEXR
openEuler:22.03-LTS-SP3
 before 3.1.5-3.oe2203sp3
3.1.5-3.oe2203sp3
openexr
Root:Debian:11
 before 2.5.4-2+deb11u1.root.io.8
2.5.4-2+deb11u1.root.io.82.5.4-2+deb11u1.root.io.12.5.4-2+deb11u1.root.io.42.5.4-2+deb11u1.root.io.62.5.4-2+deb11u1.root.io.72.5.4-2+deb11u1.root.io.132.5.4-2+deb11u1.root.io.22.5.4-2+deb11u1.root.io.32.5.4-2+deb11u1.root.io.142.5.4-2+deb11u1.root.io.52.5.4-2+deb11u1.root.io.102.5.4-2+deb11u1.aikido.172.5.4-2+deb11u1.root.io.92.5.4-2+deb11u1.root.io.122.5.4-2+deb11u1.aikido.162.5.4-2+deb11u1.root.io.112.5.4-2+deb11u1.root.io.152.5.4-2+deb11u1.aikido.18
rootio-openexr
Root:Debian:11
 before 2.5.4-2+deb11u1.root.io.8
2.5.4-2+deb11u1.root.io.82.5.4-2+deb11u1.root.io.12.5.4-2+deb11u1.root.io.42.5.4-2+deb11u1.root.io.62.5.4-2+deb11u1.root.io.72.5.4-2+deb11u1.root.io.132.5.4-2+deb11u1.root.io.22.5.4-2+deb11u1.root.io.32.5.4-2+deb11u1.root.io.142.5.4-2+deb11u1.root.io.52.5.4-2+deb11u1.root.io.102.5.4-2+deb11u1.aikido.172.5.4-2+deb11u1.root.io.92.5.4-2+deb11u1.root.io.122.5.4-2+deb11u1.aikido.162.5.4-2+deb11u1.root.io.112.5.4-2+deb11u1.root.io.152.5.4-2+deb11u1.aikido.18
openexr
Root:Debian:12
 before 3.1.5-5.root.io.8
3.1.5-5.root.io.83.1.5-5.root.io.93.1.5-5.root.io.103.1.5-5.root.io.73.1.5-5.root.io.33.1.5-5.root.io.53.1.5-5.root.io.43.1.5-5.root.io.153.1.5-5.root.io.63.1.5-5.root.io.213.1.5-5.root.io.223.1.5-5.root.io.123.1.5-5.root.io.233.1.5-5.root.io.133.1.5-5.root.io.143.1.5-5.root.io.113.1.5-5.root.io.163.1.5-5.root.io.173.1.5-5.root.io.183.1.5-5.root.io.193.1.5-5.root.io.203.1.5-5.aikido.243.1.5-5.aikido.25
rootio-openexr
Root:Debian:12
 before 3.1.5-5.root.io.8
3.1.5-5.root.io.83.1.5-5.root.io.93.1.5-5.root.io.103.1.5-5.root.io.73.1.5-5.root.io.33.1.5-5.root.io.53.1.5-5.root.io.43.1.5-5.root.io.153.1.5-5.root.io.63.1.5-5.root.io.213.1.5-5.root.io.223.1.5-5.root.io.123.1.5-5.root.io.233.1.5-5.root.io.133.1.5-5.root.io.143.1.5-5.root.io.113.1.5-5.root.io.163.1.5-5.root.io.173.1.5-5.root.io.183.1.5-5.root.io.193.1.5-5.root.io.203.1.5-5.aikido.243.1.5-5.aikido.25
openexr
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.2.0-1ubuntu32.2.0-7ubuntu12.2.0-9ubuntu12.2.0-10ubuntu22.2.0-10ubuntu2.1
Show 8 moreShow less
2.2.0-10ubuntu2.22.2.0-10ubuntu2.32.2.0-10ubuntu2.42.2.0-10ubuntu2.62.2.0-10ubuntu2.6+esm12.2.0-10ubuntu2.6+esm22.2.0-10ubuntu2.6+esm32.2.0-10ubuntu2.6+esm4
 None known
openexr
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.0-11ubuntu12.2.0-11.1ubuntu12.2.0-11.1ubuntu1.12.2.0-11.1ubuntu1.22.2.0-11.1ubuntu1.3
Show 6 moreShow less
2.2.0-11.1ubuntu1.42.2.0-11.1ubuntu1.62.2.0-11.1ubuntu1.72.2.0-11.1ubuntu1.82.2.0-11.1ubuntu1.92.2.0-11.1ubuntu1.9+esm1
 None known
openexr
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.2.1-4.1ubuntu12.3.0-62.3.0-6build12.3.0-6ubuntu0.12.3.0-6ubuntu0.2
Show 4 moreShow less
2.3.0-6ubuntu0.32.3.0-6ubuntu0.52.3.0-6ubuntu0.5+esm12.3.0-6ubuntu0.5+esm2
 None known
openexr
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.5.4-22.5.7-12.5.7-1ubuntu0.1~esm12.5.7-1ubuntu0.1~esm2
 None known
openexr
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.1.5-5.13.1.5-5.1build13.1.5-5.1build23.1.5-5.1build33.1.5-5.1ubuntu0.1~esm1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-31047 is a low vulnerability (CVSS 3.3) in Openexr, published April 8, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in openexr 3.1.1-2.el9.tuxcare.els2.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open