{"id":"CVE-2026-59984","aliases":["ALPINE-CVE-2026-59984","BELL-CVE-2026-59984","CLSA-2026-1792627161","CLSA-2026-1792628290","DEBIAN-CVE-2026-59984","EUVD-2026-65693","GHSA-92pq-9qv4-g68q","SUSE-SU-2026:23604-1","UBUNTU-CVE-2026-59984","openSUSE-SU-2026:11612-1","openSUSE-SU-2026:12184-1","openSUSE-SU-2026:21737-1"],"status":"published","title":"OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00172,"percentile":0.06675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-08-25T18:13:01Z","modified":"2026-11-11T07:00:13Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"openexr","fixed_in":["3.4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openexr","fixed_in":["3.4.15-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openexr","fixed_in":["3.2.12-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openexr","fixed_in":["3.4.14-0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.15-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.4-r0"},{"fixed":"3.4.15-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els11"}]}],"bundled":11},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els11"}]}],"bundled":11},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els11"}]}],"bundled":11},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els11"}]}],"bundled":11},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openexr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els11"}]}],"bundled":11},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openexr-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els11"}]}],"bundled":11},{"source":"osv","ecosystem":"Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-1","3.1.13-2","3.1.5-5","3.1.5-5.1","3.1.5-5.1+hurd.1","3.2.12-1~deb13u1","3.4.14-0.1","3.4.15+ds-1","3.4.16+ds-1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4","3.5.2+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-1~deb13u1"}]}],"versions":["3.1.13-2"]},{"source":"osv","ecosystem":"Debian:14","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-0.1"}]}],"versions":["3.1.13-2","3.2.12-1~deb13u1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1ubuntu3","2.2.0-7ubuntu1","2.2.0-9ubuntu1","2.2.0-10ubuntu2","2.2.0-10ubuntu2.1","2.2.0-10ubuntu2.2","2.2.0-10ubuntu2.3","2.2.0-10ubuntu2.4","2.2.0-10ubuntu2.6","2.2.0-10ubuntu2.6+esm1","2.2.0-10ubuntu2.6+esm2","2.2.0-10ubuntu2.6+esm3","2.2.0-10ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-11ubuntu1","2.2.0-11.1ubuntu1","2.2.0-11.1ubuntu1.1","2.2.0-11.1ubuntu1.2","2.2.0-11.1ubuntu1.3","2.2.0-11.1ubuntu1.4","2.2.0-11.1ubuntu1.6","2.2.0-11.1ubuntu1.7","2.2.0-11.1ubuntu1.8","2.2.0-11.1ubuntu1.9","2.2.0-11.1ubuntu1.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-4.1ubuntu1","2.3.0-6","2.3.0-6build1","2.3.0-6ubuntu0.1","2.3.0-6ubuntu0.2","2.3.0-6ubuntu0.3","2.3.0-6ubuntu0.5","2.3.0-6ubuntu0.5+esm1","2.3.0-6ubuntu0.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.4-2","2.5.7-1","2.5.7-1ubuntu0.1~esm1","2.5.7-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.5-5.1","3.1.5-5.1build1","3.1.5-5.1build2","3.1.5-5.1build3","3.1.5-5.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2build1","3.4.6+ds-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2","3.1.13-2build1","3.1.13-2ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.16-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.10.1"}]}],"bundled":11}],"products":[{"vendor":"academysoftwarefoundation","product":"openexr"}],"references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-92pq-9qv4-g68q","tags":["x_refsource_CONFIRM","exploit","advisory","report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14","tags":["x_refsource_MISC","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-59984","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-59984","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792627161.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55059","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55373","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59984","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61555","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792628290.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59984.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59984","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623604-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276428","tags":["report"]},{"url":"https://bugzilla.suse.com/1276848","tags":["report"]},{"url":"https://bugzilla.suse.com/1276849","tags":["report"]},{"url":"https://bugzilla.suse.com/1276850","tags":["report"]},{"url":"https://bugzilla.suse.com/1276853","tags":["report"]},{"url":"https://bugzilla.suse.com/1276855","tags":["report"]},{"url":"https://bugzilla.suse.com/1276856","tags":["report"]},{"url":"https://bugzilla.suse.com/1276857","tags":["report"]},{"url":"https://bugzilla.suse.com/1276858","tags":["report"]},{"url":"https://bugzilla.suse.com/1276859","tags":["report"]},{"url":"https://bugzilla.suse.com/1276862","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68515","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-59984","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59984","tags":["report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/3a4214aa73041c194e450cdd6a52c0bf9f17a237","tags":["report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/2a7386be8ec1b637dd7c6c3b91db47a6c472ed01","tags":["report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/c550555a1657398e6a9f96c3530f8b1370a6fd94","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68516","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-59984","title":"OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:13:01.835Z","modified":"2026-08-25T18:38:43.746Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-65693","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:13:01Z","modified":"2026-08-25T18:38:43Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:32.174502Z"}],"nvd":[{"id":"CVE-2026-59984","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:17:57.06Z","modified":"2026-09-09T21:07:31.353Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:41.347728Z"}],"osv":[{"id":"ALPINE-CVE-2026-59984","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:17:57.06Z","modified":"2026-11-03T06:33:03.894928049Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-59984","status":"published","published":"2026-09-02T13:33:21.703527Z","modified":"2026-09-03T07:15:06.715591599Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-59984","title":"OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:13:01.835Z","modified":"2026-10-28T02:30:41.994834973Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"DEBIAN-CVE-2026-59984","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:17:57.06Z","modified":"2026-11-11T07:00:13.189969759Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T07:25:41.918486Z"},{"id":"UBUNTU-CVE-2026-59984","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:17:00Z","modified":"2026-10-17T12:56:00.57777696Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1792627161","title":"openexr: Fix of 11 CVEs","description":"- CVE-2026-54920: validate the data window and pre-initialise every level\n  pointer in OpenEXRUtil Image::resize(), so an overflowing level size no\n  longer leaves clearLevels() deleting uninitialised ImageLevel pointers\n- CVE-2026-55059: map the row index with dataWindow.min.y instead of min.x in\n  SampleCountChannel::set(int, unsigned int[]) and bounds-check the per-pixel\n  setter, so a valid row no longer writes before the sample-count buffer\n- CVE-2026-55373: reject sample counts above 0x80000000 in roundListSizeUp(),\n  so the unsigned shift loop can no longer wrap to zero and spin forever\n- CVE-2026-59183: widen the chunk width, height and row index to int64_t in\n  unpack_sample_table(), so a large deep tile no longer overflows the\n  sample-table index arithmetic and reads unmapped memory\n- CVE-2026-59184: index the TypedFlatImageChannel row() accessors from the\n  compact _pixels array instead of the absolute-coordinate _base pointer, so\n  writing rows of an image with a non-zero data window origin no longer\n  writes outside the pixel buffer\n- CVE-2026-59186: validate Array/Array2D dimensions and compute the Array2D\n  element count in 64-bit arithmetic, so an oversized tile no longer\n  under-allocates the Rgba conversion buffer on ILP32 builds\n- CVE-2026-59189: index the TypedDeepImageChannel row() accessors from the\n  compact _sampleListPointers array instead of the absolute-coordinate _base\n  pointer, so reading rows of a deep image with a non-zero data window origin\n  no longer reads outside the sample-list pointer buffer\n- CVE-2026-59981: index SampleCountChannel::row() from the compact _numSamples\n  array instead of the absolute-coordinate _base pointer, so row(0) stays\n  inside the allocation for a deep image with a non-zero data window origin\n- CVE-2026-59983: compute the deep sample-count table size in uint64_t and\n  reject a truncating conversion in update_pack_unpack_ptrs(), so an ILP32\n  build no longer allocates a wrapped-to-zero table\n- CVE-2026-59984: reject a scratch-buffer size that does not survive the\n  conversion to size_t in internal_exr_undo_b44() and internal_exr_undo_b44a(),\n  so B44/B44A decode no longer writes past a truncated ILP32 allocation\n- CVE-2026-61555: return defaultViewName() instead of multiView[0] in\n  viewFromChannelName(), so a crafted empty multiView attribute no longer\n  indexes an empty vector","status":"published","published":"2026-10-21T23:59:41Z","modified":"2026-10-26T09:31:01.320079102Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792628290","title":"openexr: Fix of 11 CVEs","description":"- CVE-2026-54920: validate the data window and pre-initialise every level\n  pointer in OpenEXRUtil Image::resize(), so an overflowing level size no\n  longer leaves clearLevels() deleting uninitialised ImageLevel pointers\n- CVE-2026-55059: map the row index with dataWindow.min.y instead of min.x in\n  SampleCountChannel::set(int, unsigned int[]) and bounds-check the per-pixel\n  setter, so a valid row no longer writes before the sample-count buffer\n- CVE-2026-55373: reject sample counts above 0x80000000 in roundListSizeUp(),\n  so the unsigned shift loop can no longer wrap to zero and spin forever\n- CVE-2026-59183: widen the chunk width, height and row index to int64_t in\n  unpack_sample_table(), so a large deep tile no longer overflows the\n  sample-table index arithmetic and reads unmapped memory\n- CVE-2026-59184: index the TypedFlatImageChannel row() accessors from the\n  compact _pixels array instead of the absolute-coordinate _base pointer, so\n  writing rows of an image with a non-zero data window origin no longer\n  writes outside the pixel buffer\n- CVE-2026-59186: validate Array/Array2D dimensions and compute the Array2D\n  element count in 64-bit arithmetic, so an oversized tile no longer\n  under-allocates the Rgba conversion buffer on ILP32 builds\n- CVE-2026-59189: index the TypedDeepImageChannel row() accessors from the\n  compact _sampleListPointers array instead of the absolute-coordinate _base\n  pointer, so reading rows of a deep image with a non-zero data window origin\n  no longer reads outside the sample-list pointer buffer\n- CVE-2026-59981: index SampleCountChannel::row() from the compact _numSamples\n  array instead of the absolute-coordinate _base pointer, so row(0) stays\n  inside the allocation for a deep image with a non-zero data window origin\n- CVE-2026-59983: compute the deep sample-count table size in uint64_t and\n  reject a truncating conversion in update_pack_unpack_ptrs(), so an ILP32\n  build no longer allocates a wrapped-to-zero table\n- CVE-2026-59984: reject a scratch-buffer size that does not survive the\n  conversion to size_t in internal_exr_undo_b44() and internal_exr_undo_b44a(),\n  so B44/B44A decode no longer writes past a truncated ILP32 allocation\n- CVE-2026-61555: return defaultViewName() instead of multiView[0] in\n  viewFromChannelName(), so a crafted empty multiView attribute no longer\n  indexes an empty vector","status":"published","published":"2026-10-22T11:12:08Z","modified":"2026-10-26T09:31:36.614740641Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"openSUSE-SU-2026:11612-1","title":"libIex-3_4-33-3.4.14-1.1 on GA media","description":"These are all security issues fixed in the libIex-3_4-33-3.4.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:01:51.561724459Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12184-1","title":"python313-OpenEXR-3.4.16-1.1 on GA media","description":"These are all security issues fixed in the python313-OpenEXR-3.4.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-18T00:00:00Z","modified":"2026-10-19T09:30:04.174369125Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21737-1","title":"Security update for openexr","description":"This update for openexr fixes the following issues:\n\n- CVE-2026-59183: unmapped memory access leading to crash due to `int32_t` multiplication overflow in\n  `unpack_sample_table()` when decoding a crafted deep tiled EXR file (bsc#1276428).\n- CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero `dataWindow.min`\n  (bsc#1276849).\n- CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public\n  `TiledRgbaInputFile` RGBA API (bsc#1276850).\n- CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276855).\n- CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276862).\n- CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero `dataWindow`\n  origin (bsc#1276853).\n- CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR\n  (bsc#1276856).\n- CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR\n  (bsc#1276857).\n- CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR\n  (bsc#1276858).\n- CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty `multiView` header attribute\n  (bsc#1276859).\n- CVE-2026-68515: heap out-of-bounds write in `exrmultiview` when combining two specially crafted, individually valid\n  scanline EXR files whose union `dataWindow` is not aligned to one view's channel subsampling (bsc#1276848).\n","status":"published","published":"2026-09-02T09:40:22Z","modified":"2026-09-09T18:23:13.492288822Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23604-1","title":"Security update for openexr","description":"This update for openexr fixes the following issues:\n\n- CVE-2026-59183: unmapped memory access leading to crash due to `int32_t` multiplication overflow in\n  `unpack_sample_table()` when decoding a crafted deep tiled EXR file (bsc#1276428).\n- CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero `dataWindow.min`\n  (bsc#1276849).\n- CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public\n  `TiledRgbaInputFile` RGBA API (bsc#1276850).\n- CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276855).\n- CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276862).\n- CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero `dataWindow`\n  origin (bsc#1276853).\n- CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR\n  (bsc#1276856).\n- CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR\n  (bsc#1276857).\n- CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR\n  (bsc#1276858).\n- CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty `multiView` header attribute\n  (bsc#1276859).\n- CVE-2026-68515: heap out-of-bounds write in `exrmultiview` when combining two specially crafted, individually valid\n  scanline EXR files whose union `dataWindow` is not aligned to one view's channel subsampling (bsc#1276848).\n","status":"published","published":"2026-09-02T09:40:54Z","modified":"2026-09-29T18:23:19.102204578Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}