Every CVE Search/ Get API key

CVE-2023-5841

OpenEXR Heap Overflow in Scanline Deep Data Parsing

9.1 CriticalFix available

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.25%Up 1.2 points since Feb 8, 2024
90%50%10%1%

What each source reports

NVD Score used 9.1

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Record
CVE-2023-5841
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-122, CWE-787
Updated
2026-11-02
CVE List 9.1

OpenEXR Heap Overflow in Scanline Deep Data Parsing

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Record
CVE-2023-5841
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2023-58123 9.1

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Record
EUVD-2023-58123
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-gxmr-rxpv-c8fq 9.1

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep...

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability.

Record
GHSA-gxmr-rxpv-c8fq
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-122, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2023-5841 9.1

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Record
ALPINE-CVE-2023-5841
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
OSVAZL-62324 9.1

CVE-2023-5841 affecting package OpenEXR 2.3.0-6

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Record
AZL-62324
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-05
Show 19 moreShow less
OSV 9.1

OpenEXR Heap Overflow in Scanline Deep Data Parsing

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Record
CVE-2023-5841
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-122
Updated
2026-11-02
OSVDEBIAN-CVE-2023-5841 9.1

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Record
DEBIAN-CVE-2023-5841
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVJLSEC-2026-133 9.1

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Record
JLSEC-2026-133
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2024-1215 9.1

OpenEXR security update

OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.

Security Fix(es):

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library. (CVE-2023-5841)

Record
OESA-2024-1215
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2024-1216 9.1

OpenEXR security update

OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.

Security Fix(es):

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library. (CVE-2023-5841)

Record
OESA-2024-1216
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2024-1217 9.1

OpenEXR security update

OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.

Security Fix(es):

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library. (CVE-2023-5841)

Record
OESA-2024-1217
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2024-1218 9.1

OpenEXR security update

OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.

Security Fix(es):

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library. (CVE-2023-5841)

Record
OESA-2024-1218
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2024:8800 9.1

Red Hat Security Advisory: openexr security update

Record
RHSA-2024:8800
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2024:8801 9.1

Red Hat Security Advisory: openexr security update

Record
RHSA-2024:8801
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2024:8802 9.1

Red Hat Security Advisory: openexr security update

Record
RHSA-2024:8802
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2024:9548 9.1

Red Hat Security Advisory: openexr security update

Record
RHSA-2024:9548
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2023-5841 9.1

CVE-2023-5841 in openexr - Patched by Root

Root has patched CVE-2023-5841 in the openexr package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2023-5841
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-5841 9.1

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Record
UBUNTU-CVE-2023-5841
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVALSA-2024:8800 No score

Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.

Security Fix(es):

  • OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:8800
Updated
2026-11-02
OSVALSA-2024:9548 No score

Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.

Security Fix(es):

  • OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:9548
Updated
2026-11-02
OSVCLSA-2025-1749743322 No score

openexr: Fix of CVE-2023-5841

  • CVE-2023-5841: fix heap-based buffer overflow vulnerability
Record
CLSA-2025-1749743322
Updated
2026-11-02
OSVopenSUSE-SU-2024:13683-1 No score

libIex-3_1-30-32bit-3.1.11-1.3 on GA media

These are all security issues fixed in the libIex-3_1-30-32bit-3.1.11-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13683-1
Updated
2026-11-02
OSVRLSA-2024:8800 No score

Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.

Security Fix(es):

  • OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:8800
Updated
2026-11-02
OSVRLSA-2024:9548 No score

Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.

Security Fix(es):

  • OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:9548
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openexr
Alpine:v3.19
before 3.1.12-r0
3.1.12-r0
openexr
Alpine:v3.20
before 3.1.12-r0
3.1.12-r0
openexr
Alpine:v3.21
before 3.1.12-r0
3.1.12-r0
openexr
Alpine:v3.22
before 3.1.12-r0
3.1.12-r0
openexr
Alpine:v3.23
before 3.1.12-r0
3.1.12-r0
openexr
Alpine:v3.24
before 3.1.12-r0
3.1.12-r0
openexr
AlmaLinux:9
before 3.1.1-2.el9_4.1
3.1.1-2.el9_4.1
openexr-devel
AlmaLinux:9
before 3.1.1-2.el9_4.1
3.1.1-2.el9_4.1
openexr-libs
AlmaLinux:9
before 3.1.1-2.el9_4.1
3.1.1-2.el9_4.1
openexr
AlmaLinux:9
before 3.1.1-2.el9_5.1
3.1.1-2.el9_5.1
Show 50 moreShow less
Affected packages
PackageAffectedFixed
openexr-devel
AlmaLinux:9
before 3.1.1-2.el9_5.1
3.1.1-2.el9_5.1
openexr-libs
AlmaLinux:9
before 3.1.1-2.el9_5.1
3.1.1-2.el9_5.1
OpenEXR
Azure Linux:3
through 2.3.0-6 None known
openexr
TuxCare:AlmaLinux:9.2
before 3.1.1-2.el9.tuxcare.els1
3.1.1-2.el9.tuxcare.els1
openexr-devel
TuxCare:AlmaLinux:9.2
before 3.1.1-2.el9.tuxcare.els1
3.1.1-2.el9.tuxcare.els1
openexr-libs
TuxCare:AlmaLinux:9.2
before 3.1.1-2.el9.tuxcare.els1
3.1.1-2.el9.tuxcare.els1
openexr
Debian:12
All versions, plus listed versions
3.1.13-13.1.13-23.1.5-53.1.5-5.13.1.5-5.1+hurd.1
Show 8 moreShow less
3.4.14-0.13.4.15+ds-13.4.16+ds-13.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-43.5.2+ds-1
None known
openexr
Debian:13
before 3.1.13-1
3.1.13-1
openexr
Debian:14
before 3.1.13-1
3.1.13-1
OpenEXR_jll
Julia
before 3.2.4+0
3.2.4+0
OpenEXR
openEuler:22.03-LTS
before 3.1.5-2.oe2203
3.1.5-2.oe2203
OpenEXR
openEuler:22.03-LTS-SP1
before 3.1.5-2.oe2203sp1
3.1.5-2.oe2203sp1
OpenEXR
openEuler:22.03-LTS-SP2
before 3.1.5-2.oe2203sp2
3.1.5-2.oe2203sp2
OpenEXR
openEuler:22.03-LTS-SP3
before 3.1.5-2.oe2203sp3
3.1.5-2.oe2203sp3
openexr
Red Hat:enterprise_linux:9::appstream
before 0:3.1.1-2.el9_4.1
0:3.1.1-2.el9_4.1
openexr-debuginfo
Red Hat:enterprise_linux:9::appstream
before 0:3.1.1-2.el9_4.1
0:3.1.1-2.el9_4.1
openexr-debugsource
Red Hat:enterprise_linux:9::appstream
before 0:3.1.1-2.el9_4.1
0:3.1.1-2.el9_4.1
openexr-libs
Red Hat:enterprise_linux:9::appstream
before 0:3.1.1-2.el9_4.1
0:3.1.1-2.el9_4.1
openexr-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
before 0:3.1.1-2.el9_4.1
0:3.1.1-2.el9_4.1
openexr-debuginfo
Red Hat:enterprise_linux:9::crb
before 0:3.1.1-2.el9_4.1
0:3.1.1-2.el9_4.1
openexr-debugsource
Red Hat:enterprise_linux:9::crb
before 0:3.1.1-2.el9_4.1
0:3.1.1-2.el9_4.1
openexr-devel
Red Hat:enterprise_linux:9::crb
before 0:3.1.1-2.el9_4.1
0:3.1.1-2.el9_4.1
openexr-libs-debuginfo
Red Hat:enterprise_linux:9::crb
before 0:3.1.1-2.el9_4.1
0:3.1.1-2.el9_4.1
openexr
Red Hat:rhel_eus:9.2::appstream
before 0:3.1.1-2.el9_2.1
0:3.1.1-2.el9_2.1
openexr-debuginfo
Red Hat:rhel_eus:9.2::appstream
before 0:3.1.1-2.el9_2.1
0:3.1.1-2.el9_2.1
openexr-debugsource
Red Hat:rhel_eus:9.2::appstream
before 0:3.1.1-2.el9_2.1
0:3.1.1-2.el9_2.1
openexr-libs
Red Hat:rhel_eus:9.2::appstream
before 0:3.1.1-2.el9_2.1
0:3.1.1-2.el9_2.1
openexr-libs-debuginfo
Red Hat:rhel_eus:9.2::appstream
before 0:3.1.1-2.el9_2.1
0:3.1.1-2.el9_2.1
openexr-debuginfo
Red Hat:rhel_eus:9.2::crb
before 0:3.1.1-2.el9_2.1
0:3.1.1-2.el9_2.1
openexr-debugsource
Red Hat:rhel_eus:9.2::crb
before 0:3.1.1-2.el9_2.1
0:3.1.1-2.el9_2.1
openexr-devel
Red Hat:rhel_eus:9.2::crb
before 0:3.1.1-2.el9_2.1
0:3.1.1-2.el9_2.1
openexr-libs-debuginfo
Red Hat:rhel_eus:9.2::crb
before 0:3.1.1-2.el9_2.1
0:3.1.1-2.el9_2.1
openexr
Red Hat:rhel_e4s:9.0::appstream
before 0:3.1.1-2.el9_0.1
0:3.1.1-2.el9_0.1
openexr-debuginfo
Red Hat:rhel_e4s:9.0::appstream
before 0:3.1.1-2.el9_0.1
0:3.1.1-2.el9_0.1
openexr-debugsource
Red Hat:rhel_e4s:9.0::appstream
before 0:3.1.1-2.el9_0.1
0:3.1.1-2.el9_0.1
openexr-libs
Red Hat:rhel_e4s:9.0::appstream
before 0:3.1.1-2.el9_0.1
0:3.1.1-2.el9_0.1
openexr-libs-debuginfo
Red Hat:rhel_e4s:9.0::appstream
before 0:3.1.1-2.el9_0.1
0:3.1.1-2.el9_0.1
openexr
Red Hat:enterprise_linux:9::appstream
before 0:3.1.1-2.el9_5.1
0:3.1.1-2.el9_5.1
openexr-debuginfo
Red Hat:enterprise_linux:9::appstream
before 0:3.1.1-2.el9_5.1
0:3.1.1-2.el9_5.1
openexr-debugsource
Red Hat:enterprise_linux:9::appstream
before 0:3.1.1-2.el9_5.1
0:3.1.1-2.el9_5.1
openexr-libs
Red Hat:enterprise_linux:9::appstream
before 0:3.1.1-2.el9_5.1
0:3.1.1-2.el9_5.1
openexr-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
before 0:3.1.1-2.el9_5.1
0:3.1.1-2.el9_5.1
openexr-debuginfo
Red Hat:enterprise_linux:9::crb
before 0:3.1.1-2.el9_5.1
0:3.1.1-2.el9_5.1
openexr-debugsource
Red Hat:enterprise_linux:9::crb
before 0:3.1.1-2.el9_5.1
0:3.1.1-2.el9_5.1
openexr-devel
Red Hat:enterprise_linux:9::crb
before 0:3.1.1-2.el9_5.1
0:3.1.1-2.el9_5.1
openexr-libs-debuginfo
Red Hat:enterprise_linux:9::crb
before 0:3.1.1-2.el9_5.1
0:3.1.1-2.el9_5.1
openexr
Rocky Linux:9
before 0:3.1.1-2.el9_4.1
0:3.1.1-2.el9_4.1
openexr
Root:Debian:12
before 3.1.5-5.root.io.8
3.1.5-5.root.io.83.1.5-5.root.io.93.1.5-5.root.io.103.1.5-5.root.io.73.1.5-5.root.io.33.1.5-5.root.io.13.1.5-5.root.io.53.1.5-5.root.io.43.1.5-5.root.io.153.1.5-5.root.io.63.1.5-5.root.io.23.1.5-5.root.io.213.1.5-5.root.io.223.1.5-5.root.io.123.1.5-5.root.io.233.1.5-5.root.io.133.1.5-5.root.io.143.1.5-5.root.io.113.1.5-5.root.io.163.1.5-5.root.io.173.1.5-5.root.io.183.1.5-5.root.io.193.1.5-5.root.io.203.1.5-5.aikido.243.1.5-5.aikido.25
rootio-openexr
Root:Debian:12
before 3.1.5-5.root.io.8
3.1.5-5.root.io.83.1.5-5.root.io.93.1.5-5.root.io.103.1.5-5.root.io.73.1.5-5.root.io.33.1.5-5.root.io.13.1.5-5.root.io.53.1.5-5.root.io.43.1.5-5.root.io.153.1.5-5.root.io.63.1.5-5.root.io.23.1.5-5.root.io.213.1.5-5.root.io.223.1.5-5.root.io.123.1.5-5.root.io.233.1.5-5.root.io.133.1.5-5.root.io.143.1.5-5.root.io.113.1.5-5.root.io.163.1.5-5.root.io.173.1.5-5.root.io.183.1.5-5.root.io.193.1.5-5.root.io.203.1.5-5.aikido.243.1.5-5.aikido.25
openexr
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
3.1.5-5.13.1.5-5.1build13.1.5-5.1build23.1.5-5.1build33.1.5-5.1ubuntu0.1~esm1
None known

History

History
RecordedChangedSources
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-5841 is a critical vulnerability (CVSS 9.1) in Academy Software Foundation Openexr, published February 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in openexr 3.1.12-r0.

References

Show 32 moreShow less
MoveEnter Open