{"id":"CVE-2026-59982","aliases":["ALPINE-CVE-2026-59982","ALSA-2026:84796","ALSA-2026:86983","BELL-CVE-2026-59982","DEBIAN-CVE-2026-59982","EUVD-2026-65690","GHSA-6662-fq6f-93mp","OESA-2026-4684","OESA-2026-4837","RHSA-2026:84796","RLSA-2026:84796","RLSA-2026:86983","ROOT-OS-DEBIAN-11-CVE-2026-59982","ROOT-OS-DEBIAN-12-CVE-2026-59982","ROOT-OS-DEBIAN-13-CVE-2026-59982","SUSE-SU-2026:23604-1","SUSE-SU-2026:4003-1","UBUNTU-CVE-2026-59982","openSUSE-SU-2026:11612-1","openSUSE-SU-2026:12184-1","openSUSE-SU-2026:21737-1"],"status":"published","title":"OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00314,"percentile":0.24577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787"],"published":"2026-08-25T17:59:25Z","modified":"2026-11-11T12:45:08Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"openexr","fixed_in":["3.4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openexr","fixed_in":["3.4.15-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openexr","fixed_in":["3.2.12-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openexr","fixed_in":["3.4.14-0.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"openexr","fixed_in":["2.5.4-2+deb11u1.aikido.18"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-openexr","fixed_in":["2.5.4-2+deb11u1.aikido.18"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"openexr","fixed_in":["3.1.5-5.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-openexr","fixed_in":["3.1.5-5.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"openexr","fixed_in":["3.1.13-2.aikido.15"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-openexr","fixed_in":["3.1.13-2.aikido.15"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.15-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10-8.el10_2.5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10-8.el10_2.5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10-8.el10_2.5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9_8.5"}]}],"bundled":5},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.4-r0"},{"fixed":"3.4.15-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-1","3.1.13-2","3.1.5-5","3.1.5-5.1","3.1.5-5.1+hurd.1","3.2.12-1~deb13u1","3.4.14-0.1","3.4.15+ds-1","3.4.16+ds-1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4","3.5.2+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-1~deb13u1"}]}],"versions":["3.1.13-2"]},{"source":"osv","ecosystem":"Debian:14","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-0.1"}]}],"versions":["3.1.13-2","3.2.12-1~deb13u1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11-10.oe2403sp3"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11-12.oe2403sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_2.5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openexr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_2.5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openexr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_2.5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_2.5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openexr-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_2.5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_2.5"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.10-8.el10_2.5"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-3.el9_8.5"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:Debian:11","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2+deb11u1.aikido.18"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2+deb11u1.aikido.18"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-5.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-5.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-2.aikido.15"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-2.aikido.15"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1ubuntu3","2.2.0-7ubuntu1","2.2.0-9ubuntu1","2.2.0-10ubuntu2","2.2.0-10ubuntu2.1","2.2.0-10ubuntu2.2","2.2.0-10ubuntu2.3","2.2.0-10ubuntu2.4","2.2.0-10ubuntu2.6","2.2.0-10ubuntu2.6+esm1","2.2.0-10ubuntu2.6+esm2","2.2.0-10ubuntu2.6+esm3","2.2.0-10ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-11ubuntu1","2.2.0-11.1ubuntu1","2.2.0-11.1ubuntu1.1","2.2.0-11.1ubuntu1.2","2.2.0-11.1ubuntu1.3","2.2.0-11.1ubuntu1.4","2.2.0-11.1ubuntu1.6","2.2.0-11.1ubuntu1.7","2.2.0-11.1ubuntu1.8","2.2.0-11.1ubuntu1.9","2.2.0-11.1ubuntu1.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-4.1ubuntu1","2.3.0-6","2.3.0-6build1","2.3.0-6ubuntu0.1","2.3.0-6ubuntu0.2","2.3.0-6ubuntu0.3","2.3.0-6ubuntu0.5","2.3.0-6ubuntu0.5+esm1","2.3.0-6ubuntu0.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.4-2","2.5.7-1","2.5.7-1ubuntu0.1~esm1","2.5.7-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.5-5.1","3.1.5-5.1build1","3.1.5-5.1build2","3.1.5-5.1build3","3.1.5-5.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2build1","3.4.6+ds-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2","3.1.13-2build1","3.1.13-2ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.16-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.10.1"}]}],"bundled":11}],"products":[{"vendor":"academysoftwarefoundation","product":"openexr"}],"references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-6662-fq6f-93mp","tags":["x_refsource_CONFIRM","advisory","article","report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1","tags":["x_refsource_MISC","fix","article","report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/55b7958ecb5ac32c427ff39c1e063f6f7bbee77c","tags":["x_refsource_MISC","fix","article","report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/aef02224ba282a802de65d16c49c1cdb82089dec","tags":["x_refsource_MISC","fix","article","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-59982","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84796","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34544","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59184","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59189","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59981","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59982","tags":["report"]},{"url":"https://bugzilla.redhat.com/2454127","tags":["report"]},{"url":"https://bugzilla.redhat.com/2523654","tags":["report"]},{"url":"https://bugzilla.redhat.com/2523671","tags":["report"]},{"url":"https://bugzilla.redhat.com/2523708","tags":["report"]},{"url":"https://bugzilla.redhat.com/2523752","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-84796.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86983","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-86983.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-59982","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59982.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59982","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59982","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61555","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68515","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4837","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523671","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523752","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84796.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34544","tags":["advisory"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/35e7aa35e22c1975606be86e859f31cc1fc598ee","tags":["article"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8","tags":["article"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-h762-rhv3-h25v","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59184","tags":["advisory"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-pqp9-558c-453q","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59189","tags":["advisory"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-hwmv-39v6-739m","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59981","tags":["advisory"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m799-ffc3-8pxc","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59982","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:84796","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:86983","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623604-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276428","tags":["report"]},{"url":"https://bugzilla.suse.com/1276848","tags":["report"]},{"url":"https://bugzilla.suse.com/1276849","tags":["report"]},{"url":"https://bugzilla.suse.com/1276850","tags":["report"]},{"url":"https://bugzilla.suse.com/1276853","tags":["report"]},{"url":"https://bugzilla.suse.com/1276855","tags":["report"]},{"url":"https://bugzilla.suse.com/1276856","tags":["report"]},{"url":"https://bugzilla.suse.com/1276857","tags":["report"]},{"url":"https://bugzilla.suse.com/1276858","tags":["report"]},{"url":"https://bugzilla.suse.com/1276859","tags":["report"]},{"url":"https://bugzilla.suse.com/1276862","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68515","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264003-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59982","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68516","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-59982","title":"OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T17:59:25.292Z","modified":"2026-08-25T19:20:27.685Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-65690","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T17:59:25Z","modified":"2026-08-25T19:20:27Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:32.174502Z"}],"nvd":[{"id":"CVE-2026-59982","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:17:56.747Z","modified":"2026-09-09T21:07:31.353Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:12:41.347728Z"}],"osv":[{"id":"ALPINE-CVE-2026-59982","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:17:56.747Z","modified":"2026-11-03T06:33:05.838851961Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-59982","status":"published","published":"2026-09-02T13:33:21.141146Z","modified":"2026-09-03T07:15:06.869919823Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-59982","title":"OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T17:59:25.292Z","modified":"2026-10-28T11:18:16.332248009Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"DEBIAN-CVE-2026-59982","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:17:56.747Z","modified":"2026-11-11T07:00:13.2000157Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T07:25:41.918486Z"},{"id":"OESA-2026-4684","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, an int32_t multiplication in OpenEXRCore\u0026apos;s unpack_sample_table() can overflow while decoding a crafted deep tiled EXR file, producing an invalid pointer that leads to a read from an unmapped memory address and a crash. Because the overflow occurs in the standard decoding path (exr_decoding_run), any application that decodes deep tiled EXR files is affected. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59183)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application writes rows through FlatHalfChannel::row(). Affected consumers are tools, converters, render pipeline components, or image-processing services that accept untrusted EXR files and use FlatHalfChannel::row() on loaded images. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59184)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 tile size. On ILP32, the Array2D\u0026lt;Rgba\u0026gt; tile-conversion buffer size calculation overflows, allocates a much smaller heap buffer, and tile decode writes past that allocation. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59186)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel\u0026lt;T\u0026gt;::row() API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin, resulting in a heap out-of-bounds read and crash, with potential information disclosure under a controlled heap layout. The flaw arises because ImfDeepImageChannel uses two conflicting coordinate models: at(x, y) uses absolute coordinates (with _base offset by dataWindow.min), while row(r) is documented as 0-based logical access. For a non-zero dataWindow.min, row(0) therefore points outside the _sampleListPointers allocation instead of at the first logical row. This issue is fixed in versions 3.3.13 and 3.4.13.(CVE-2026-59189)\n\nOpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::row() API when a deep image has a non-zero dataWindow origin. The row() accessor is documented as 0-based and computes its address from an internal base that is offset for absolute pixel coordinates, so the two coordinate models conflict whenever dataWindow.min is non-zero. For a deep image whose data window has a large negative vertical origin, row(0) points far outside the allocated sample-count buffer. An application that opens an attacker-controlled deep EXR file and accesses sample counts through row() performs an out-of-bounds read, which can crash the process or, under a controlled heap layout, return adjacent heap memory as sample-count values. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59981)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59982)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds read. The vulnerability is reached when a crafted uncompressed deep-tile EXR causes the sample-count table size calculation in OpenEXRCore decoding.c to wrap before unpack_sample_table() iterates over the full attacker-controlled tile dimensions, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59983)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-61555)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied, individually valid scanline EXR files whose union dataWindow is not aligned to one view\u0026apos;s channel subsampling. The utility allocates sampled channel storage using a truncated union_width / xSampling, then reads the sampled input through a Slice based on the misaligned union window, producing a heap out-of-bounds write. The trigger is normal public-tool processing, such as exrmultiview left A.exr right B.exr out.exr with crafted but valid inputs, so this is not solely an API or caller-precondition issue. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-68515)","status":"published","published":"2026-11-04T13:54:28Z","modified":"2026-11-04T14:00:03.058815883Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-04T14:10:48.853413Z"},{"id":"OESA-2026-4837","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp;amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, an int32_t multiplication in OpenEXRCore\u0026apos;s unpack_sample_table() can overflow while decoding a crafted deep tiled EXR file, producing an invalid pointer that leads to a read from an unmapped memory address and a crash. Because the overflow occurs in the standard decoding path (exr_decoding_run), any application that decodes deep tiled EXR files is affected. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59183)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application writes rows through FlatHalfChannel::row(). Affected consumers are tools, converters, render pipeline components, or image-processing services that accept untrusted EXR files and use FlatHalfChannel::row() on loaded images. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59184)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 tile size. On ILP32, the Array2D\u0026lt;Rgba\u0026gt; tile-conversion buffer size calculation overflows, allocates a much smaller heap buffer, and tile decode writes past that allocation. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59186)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel\u0026lt;T\u0026gt;::row() API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin, resulting in a heap out-of-bounds read and crash, with potential information disclosure under a controlled heap layout. The flaw arises because ImfDeepImageChannel uses two conflicting coordinate models: at(x, y) uses absolute coordinates (with _base offset by dataWindow.min), while row(r) is documented as 0-based logical access. For a non-zero dataWindow.min, row(0) therefore points outside the _sampleListPointers allocation instead of at the first logical row. This issue is fixed in versions 3.3.13 and 3.4.13.(CVE-2026-59189)\n\nOpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::row() API when a deep image has a non-zero dataWindow origin. The row() accessor is documented as 0-based and computes its address from an internal base that is offset for absolute pixel coordinates, so the two coordinate models conflict whenever dataWindow.min is non-zero. For a deep image whose data window has a large negative vertical origin, row(0) points far outside the allocated sample-count buffer. An application that opens an attacker-controlled deep EXR file and accesses sample counts through row() performs an out-of-bounds read, which can crash the process or, under a controlled heap layout, return adjacent heap memory as sample-count values. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59981)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-59982)\n\nOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.(CVE-2026-61555)","status":"published","published":"2026-11-11T12:26:41Z","modified":"2026-11-11T12:45:08.60677202Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"RHSA-2026:84796","title":"Red Hat Security Advisory: openexr security update","status":"published","published":"2026-10-20T10:17:50Z","modified":"2026-10-20T10:31:31.651905755Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:84796","title":"Important: openexr security update","description":"OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.\n\nSecurity Fix(es):\n\n* OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544)\n\n* OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184)\n\n* OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189)\n\n* OpenEXR: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982)\n\n* OpenEXR: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:10:14.939262Z","modified":"2026-10-20T12:15:38.491888237Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:86983","title":"Important: openexr security update","description":"OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.\n\nSecurity Fix(es):\n\n* openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544)\n\n* openexr: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982)\n\n* openexr: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184)\n\n* openexr: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189)\n\n* openexr: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-22T00:04:07.745746Z","modified":"2026-10-22T00:30:04.389339097Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-59982","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:17:00Z","modified":"2026-10-17T12:56:00.354270157Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:84796","title":"Important: openexr security update","description":"OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.  \n\nSecurity Fix(es):  \n\n  * OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544)\n  * OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184)\n  * OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189)\n  * OpenEXR: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982)\n  * OpenEXR: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:31:02.281157409Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:86983","title":"Important: openexr security update","description":"OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.  \n\nSecurity Fix(es):  \n\n  * openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544)\n  * openexr: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982)\n  * openexr: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184)\n  * openexr: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189)\n  * openexr: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-29T11:32:38.615640957Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"openSUSE-SU-2026:11612-1","title":"libIex-3_4-33-3.4.14-1.1 on GA media","description":"These are all security issues fixed in the libIex-3_4-33-3.4.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:01:51.561724459Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12184-1","title":"python313-OpenEXR-3.4.16-1.1 on GA media","description":"These are all security issues fixed in the python313-OpenEXR-3.4.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-18T00:00:00Z","modified":"2026-10-19T09:30:04.174369125Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21737-1","title":"Security update for openexr","description":"This update for openexr fixes the following issues:\n\n- CVE-2026-59183: unmapped memory access leading to crash due to `int32_t` multiplication overflow in\n  `unpack_sample_table()` when decoding a crafted deep tiled EXR file (bsc#1276428).\n- CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero `dataWindow.min`\n  (bsc#1276849).\n- CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public\n  `TiledRgbaInputFile` RGBA API (bsc#1276850).\n- CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276855).\n- CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276862).\n- CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero `dataWindow`\n  origin (bsc#1276853).\n- CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR\n  (bsc#1276856).\n- CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR\n  (bsc#1276857).\n- CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR\n  (bsc#1276858).\n- CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty `multiView` header attribute\n  (bsc#1276859).\n- CVE-2026-68515: heap out-of-bounds write in `exrmultiview` when combining two specially crafted, individually valid\n  scanline EXR files whose union `dataWindow` is not aligned to one view's channel subsampling (bsc#1276848).\n","status":"published","published":"2026-09-02T09:40:22Z","modified":"2026-09-09T18:23:13.492288822Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-59982","title":"CVE-2026-59982 in openexr - Patched by Root","description":"Root has patched CVE-2026-59982 in the openexr package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-09-02T12:13:16Z","modified":"2026-09-02T14:00:05.608480761Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-59982","title":"CVE-2026-59982 in openexr - Patched by Root","description":"Root has patched CVE-2026-59982 in the openexr package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-02T11:23:23Z","modified":"2026-09-02T12:30:05.049698704Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-59982","title":"CVE-2026-59982 in openexr - Patched by Root","description":"Root has patched CVE-2026-59982 in the openexr package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-09-02T12:18:43Z","modified":"2026-09-02T14:00:07.523187361Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23604-1","title":"Security update for openexr","description":"This update for openexr fixes the following issues:\n\n- CVE-2026-59183: unmapped memory access leading to crash due to `int32_t` multiplication overflow in\n  `unpack_sample_table()` when decoding a crafted deep tiled EXR file (bsc#1276428).\n- CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero `dataWindow.min`\n  (bsc#1276849).\n- CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public\n  `TiledRgbaInputFile` RGBA API (bsc#1276850).\n- CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276855).\n- CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276862).\n- CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero `dataWindow`\n  origin (bsc#1276853).\n- CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR\n  (bsc#1276856).\n- CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR\n  (bsc#1276857).\n- CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR\n  (bsc#1276858).\n- CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty `multiView` header attribute\n  (bsc#1276859).\n- CVE-2026-68515: heap out-of-bounds write in `exrmultiview` when combining two specially crafted, individually valid\n  scanline EXR files whose union `dataWindow` is not aligned to one view's channel subsampling (bsc#1276848).\n","status":"published","published":"2026-09-02T09:40:54Z","modified":"2026-09-29T18:23:19.102204578Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4003-1","title":"Security update for openexr","description":"This update for openexr fixes the following issues:\n\n- CVE-2026-59184: invalid heap pointer, causing out-of-bounds or use-after-free writes (bsc#1276849).\n- CVE-2026-59186: On ILP32, the Array2D\u003cRgba\u003e tile-conversion buffer size calculation overflows, allocates a much\n  smaller heap buffer, and tile decode writes past that allocation (bsc#1276850).\n- CVE-2026-59189: API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin, resulting\n  in a heap out-of-bounds read and crash, with potential information disclosure under a controlled heap layout\n  (bsc#1276855).\n- CVE-2026-59981: an attacker-controlled deep EXR file can access sample counts through row() performs an out-of-bounds\n  read, which can crash the process or, under a controlled heap layout, return adjacent heap memory as sample-count\n  values (bsc#1276862).\n- CVE-2026-59982: an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero\n  dataWindow origin (bsc#1276853).\n- CVE-2026-61555: crashing occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView\n  header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name (bsc#1276859).\n- CVE-2026-68515: The utility allocates sampled channel storage using a truncated union_width / xSampling, then reads\n  the sampled input through a Slice based on the misaligned union window, producing a heap out-of-bounds write\n  (bsc#1276848).\n","status":"published","published":"2026-09-07T07:29:50Z","modified":"2026-09-13T18:23:14.555713539Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}