{"id":"CVE-2026-59985","aliases":["ALPINE-CVE-2026-59985","BELL-CVE-2026-59985","DEBIAN-CVE-2026-59985","EUVD-2026-65695","GHSA-v6v5-344m-64vm","SUSE-SU-2026:23604-1","UBUNTU-CVE-2026-59985","openSUSE-SU-2026:11612-1","openSUSE-SU-2026:12184-1","openSUSE-SU-2026:21737-1"],"status":"published","title":"OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00172,"percentile":0.06677,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-08-25T18:16:37Z","modified":"2026-11-11T07:00:20Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"openexr","fixed_in":["3.4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openexr","fixed_in":["3.4.15-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openexr","fixed_in":["3.2.12-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openexr","fixed_in":["3.4.14-0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.15-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.4-r0"},{"fixed":"3.4.15-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-1","3.1.13-2","3.1.5-5","3.1.5-5.1","3.1.5-5.1+hurd.1","3.2.12-1~deb13u1","3.4.14-0.1","3.4.15+ds-1","3.4.16+ds-1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4","3.5.2+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-1~deb13u1"}]}],"versions":["3.1.13-2"]},{"source":"osv","ecosystem":"Debian:14","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-0.1"}]}],"versions":["3.1.13-2","3.2.12-1~deb13u1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1ubuntu3","2.2.0-7ubuntu1","2.2.0-9ubuntu1","2.2.0-10ubuntu2","2.2.0-10ubuntu2.1","2.2.0-10ubuntu2.2","2.2.0-10ubuntu2.3","2.2.0-10ubuntu2.4","2.2.0-10ubuntu2.6","2.2.0-10ubuntu2.6+esm1","2.2.0-10ubuntu2.6+esm2","2.2.0-10ubuntu2.6+esm3","2.2.0-10ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-11ubuntu1","2.2.0-11.1ubuntu1","2.2.0-11.1ubuntu1.1","2.2.0-11.1ubuntu1.2","2.2.0-11.1ubuntu1.3","2.2.0-11.1ubuntu1.4","2.2.0-11.1ubuntu1.6","2.2.0-11.1ubuntu1.7","2.2.0-11.1ubuntu1.8","2.2.0-11.1ubuntu1.9","2.2.0-11.1ubuntu1.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-4.1ubuntu1","2.3.0-6","2.3.0-6build1","2.3.0-6ubuntu0.1","2.3.0-6ubuntu0.2","2.3.0-6ubuntu0.3","2.3.0-6ubuntu0.5","2.3.0-6ubuntu0.5+esm1","2.3.0-6ubuntu0.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.4-2","2.5.7-1","2.5.7-1ubuntu0.1~esm1","2.5.7-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.5-5.1","3.1.5-5.1build1","3.1.5-5.1build2","3.1.5-5.1build3","3.1.5-5.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2build1","3.4.6+ds-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2","3.1.13-2build1","3.1.13-2ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.16-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.10.1"}]}],"bundled":11}],"products":[{"vendor":"academysoftwarefoundation","product":"openexr"}],"references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm","tags":["x_refsource_CONFIRM","exploit","advisory","report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.11","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.13","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14","tags":["x_refsource_MISC","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-59985","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-59985","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59985.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59985","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59985","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623604-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276428","tags":["report"]},{"url":"https://bugzilla.suse.com/1276848","tags":["report"]},{"url":"https://bugzilla.suse.com/1276849","tags":["report"]},{"url":"https://bugzilla.suse.com/1276850","tags":["report"]},{"url":"https://bugzilla.suse.com/1276853","tags":["report"]},{"url":"https://bugzilla.suse.com/1276855","tags":["report"]},{"url":"https://bugzilla.suse.com/1276856","tags":["report"]},{"url":"https://bugzilla.suse.com/1276857","tags":["report"]},{"url":"https://bugzilla.suse.com/1276858","tags":["report"]},{"url":"https://bugzilla.suse.com/1276859","tags":["report"]},{"url":"https://bugzilla.suse.com/1276862","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68515","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-59985","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59985","tags":["report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/b78496b324832e7cb1ff6b64373a3fe1cfa84e70","tags":["report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/393fcd3376a669503999d5dada1d95665c49fddb","tags":["report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/7cfa06bf0fd9e89bdda0f75f2920befcaf952616","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68516","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-59985","title":"OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:16:37.986Z","modified":"2026-08-25T19:16:49.514Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-65695","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:16:37Z","modified":"2026-08-25T19:16:49Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:32.174502Z"}],"nvd":[{"id":"CVE-2026-59985","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T19:16:51.82Z","modified":"2026-09-09T21:07:31.353Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:41.347728Z"}],"osv":[{"id":"ALPINE-CVE-2026-59985","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T19:16:51.82Z","modified":"2026-11-03T06:33:03.896996957Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-59985","status":"published","published":"2026-09-02T13:33:21.891575Z","modified":"2026-09-03T07:15:05.812449494Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-59985","title":"OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T18:16:37.986Z","modified":"2026-10-28T02:30:58.150254133Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"DEBIAN-CVE-2026-59985","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T19:16:51.82Z","modified":"2026-11-11T07:00:20.985921623Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T07:25:41.918486Z"},{"id":"UBUNTU-CVE-2026-59985","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.","status":"published","published":"2026-08-25T19:16:00Z","modified":"2026-10-17T12:56:00.553131744Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"openSUSE-SU-2026:11612-1","title":"libIex-3_4-33-3.4.14-1.1 on GA media","description":"These are all security issues fixed in the libIex-3_4-33-3.4.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:01:51.561724459Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12184-1","title":"python313-OpenEXR-3.4.16-1.1 on GA media","description":"These are all security issues fixed in the python313-OpenEXR-3.4.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-18T00:00:00Z","modified":"2026-10-19T09:30:04.174369125Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21737-1","title":"Security update for openexr","description":"This update for openexr fixes the following issues:\n\n- CVE-2026-59183: unmapped memory access leading to crash due to `int32_t` multiplication overflow in\n  `unpack_sample_table()` when decoding a crafted deep tiled EXR file (bsc#1276428).\n- CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero `dataWindow.min`\n  (bsc#1276849).\n- CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public\n  `TiledRgbaInputFile` RGBA API (bsc#1276850).\n- CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276855).\n- CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276862).\n- CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero `dataWindow`\n  origin (bsc#1276853).\n- CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR\n  (bsc#1276856).\n- CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR\n  (bsc#1276857).\n- CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR\n  (bsc#1276858).\n- CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty `multiView` header attribute\n  (bsc#1276859).\n- CVE-2026-68515: heap out-of-bounds write in `exrmultiview` when combining two specially crafted, individually valid\n  scanline EXR files whose union `dataWindow` is not aligned to one view's channel subsampling (bsc#1276848).\n","status":"published","published":"2026-09-02T09:40:22Z","modified":"2026-09-09T18:23:13.492288822Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23604-1","title":"Security update for openexr","description":"This update for openexr fixes the following issues:\n\n- CVE-2026-59183: unmapped memory access leading to crash due to `int32_t` multiplication overflow in\n  `unpack_sample_table()` when decoding a crafted deep tiled EXR file (bsc#1276428).\n- CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero `dataWindow.min`\n  (bsc#1276849).\n- CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public\n  `TiledRgbaInputFile` RGBA API (bsc#1276850).\n- CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276855).\n- CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero `dataWindow` origin\n  (bsc#1276862).\n- CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero `dataWindow`\n  origin (bsc#1276853).\n- CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR\n  (bsc#1276856).\n- CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR\n  (bsc#1276857).\n- CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR\n  (bsc#1276858).\n- CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty `multiView` header attribute\n  (bsc#1276859).\n- CVE-2026-68515: heap out-of-bounds write in `exrmultiview` when combining two specially crafted, individually valid\n  scanline EXR files whose union `dataWindow` is not aligned to one view's channel subsampling (bsc#1276848).\n","status":"published","published":"2026-09-02T09:40:54Z","modified":"2026-09-29T18:23:19.102204578Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}