Critical Vulnerability in OpenEXR Package: Arbitrary Code Execution Risk
Summary
RLSA-2026:7682: Important: openexr security update. Affects openexr versions < 0:3.1.10-8.el10_1.1. Fixed in 0:3.1.10-8.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenEXR is an open-source high-dynamic-range floating-point image file format designed for high-quality image processing and storage. It is widely used in visual effects and animation industries due to its ability to handle complex image data efficiently. However, the package has been found to be vulnerable to an integer overflow issue that can lead to arbitrary code execution when processing EXR files.
Vulnerability Detail
The vulnerability identified as CVE-2026-27622 arises from an integer overflow in the OpenEXR file processing mechanism. This flaw allows attackers to craft malicious EXR files that, when processed by the OpenEXR library, can execute arbitrary code on the host system. The potential ramifications include unauthorized access to system resources, data corruption, and complete system compromise. The CVSS score for this vulnerability is 7.4, indicating a high severity level.
How To Fix
Minimum fixed version
0:3.1.10-8.el10_1.1
This is the first release that contains the fix.
sudo dnf update openexrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid processing untrusted EXR files until the package is updated. Additionally, implementing strict file validation and sanitization measures can help mitigate the risk of exploitation.
Conclusion
The OpenEXR package has a critical vulnerability that can lead to arbitrary code execution through malicious EXR files. Users are strongly advised to update to the patched version to mitigate risks. Temporary workarounds should be employed until the update can be applied.
See every vulnerability recorded for openexr →
FAQ
The vulnerability is an integer overflow that can lead to arbitrary code execution when processing malicious EXR files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
As a temporary measure, avoid processing untrusted EXR files and implement strict file validation to reduce risk.
The OpenEXR package is maintained by the Rocky Enterprise Software Foundation and Red Hat.
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
