Critical Vulnerability in OpenEXR Package: Arbitrary Code Execution and Information Disclosure
Summary
RLSA-2026:19146: Important: openexr security update. Affects openexr versions < 0:3.1.10-8.el10_2.2. Fixed in 0:3.1.10-8.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenEXR is an open-source high-dynamic-range floating-point image file format designed for high-quality image processing and storage. It is widely used in visual effects and animation industries due to its ability to handle complex image data. However, the package has been found to be vulnerable to security issues that could allow attackers to execute arbitrary code or disclose sensitive information through specially crafted EXR files.
Vulnerability Detail
The vulnerability identified as CVE-2026-34588 allows for arbitrary code execution and information disclosure when a crafted EXR file is processed. This issue arises from improper handling of certain data structures within the OpenEXR library, which can be exploited by attackers to execute malicious code on the host system or extract confidential information. The potential ramifications of this vulnerability are severe, as it could lead to unauthorized access to system resources and sensitive data.
How To Fix
Minimum fixed version
0:3.1.10-8.el10_2.2
This is the first release that contains the fix.
sudo dnf update openexrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening untrusted or unknown EXR files until the package has been updated to the secure version. Additionally, implementing strict file validation and access controls can help mitigate the risk of exploitation.
Conclusion
The OpenEXR package has a critical vulnerability (CVE-2026-34588) that poses significant risks, including arbitrary code execution and information disclosure. Users are strongly advised to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for openexr →
FAQ
CVE-2026-34588 is a security vulnerability in the OpenEXR package that allows for arbitrary code execution and information disclosure through crafted EXR files.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability could lead to unauthorized code execution on the host system and potential disclosure of sensitive information.
Yes, a patched version of the OpenEXR package is available. Users should update to version 0:3.1.10-8.el10_2.2 or later.
If immediate updates are not possible, avoid opening untrusted EXR files and implement strict file validation and access controls as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
