Critical Vulnerability in OpenEXR Package: Arbitrary Code Execution and Information Disclosure
Summary
RLSA-2026:38498: Important: openexr security update. Affects openexr versions < 0:3.1.1-3.el9_8.3. Fixed in 0:3.1.1-3.el9_8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenEXR is an open-source high-dynamic-range floating-point image file format designed for high-quality image processing and storage. It is widely used in visual effects and animation due to its ability to store a wide range of color data and support for advanced imaging features. However, recent vulnerabilities have been identified that could compromise the integrity and confidentiality of data processed with this package.
Vulnerability Detail
The vulnerabilities in OpenEXR stem from an integer overflow during image resizing, which can lead to arbitrary code execution (CVE-2026-41142). Additionally, malformed EXR files can cause information disclosure and denial of service (CVE-2026-42216). These vulnerabilities can be exploited by attackers to execute malicious code or disrupt services, posing significant risks to applications relying on OpenEXR for image processing.
How To Fix
Minimum fixed version
0:3.1.1-3.el9_8.3
This is the first release that contains the fix.
sudo dnf update openexrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or malformed EXR files until the package is updated. Implement strict validation checks on EXR files before processing them to mitigate potential risks.
Conclusion
The vulnerabilities in the OpenEXR package present significant risks, including arbitrary code execution and information disclosure. It is crucial for users to update to the patched version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for openexr →
FAQ
OpenEXR is an open-source image file format used for high-dynamic-range imaging, primarily in the visual effects and animation industries.
The main vulnerabilities include arbitrary code execution via integer overflow and information disclosure/denial of service through malformed EXR files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
Regularly update your packages to the latest versions and monitor for vulnerabilities using tools like Vulert, which can alert you in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
