Critical Memory Corruption and Denial of Service Vulnerabilities in OpenEXR Package
Summary
RLSA-2026:84796: Important: openexr security update. Affects openexr versions < 0:3.1.10-8.el10_2.5. Fixed in 0:3.1.10-8.el10_2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenEXR is an open-source high-dynamic-range floating-point image file format designed for high-quality image processing and storage. It is widely used in visual effects and animation industries due to its ability to handle a wide range of color and brightness levels. However, recent vulnerabilities have been identified that could compromise the integrity and availability of applications utilizing this package.
Vulnerability Detail
The vulnerabilities in OpenEXR stem from improper handling of crafted EXR files, leading to memory corruption, out-of-bounds writes, and information disclosure. These issues can result in Denial of Service (DoS) attacks, where the application becomes unresponsive, or sensitive information being exposed. The vulnerabilities are tracked under multiple CVEs, including CVE-2026-34544, CVE-2026-59184, CVE-2026-59189, CVE-2026-59981, and CVE-2026-59982, with a CVSS score of 7.1 indicating a high severity level.
How To Fix
Minimum fixed version
0:3.1.10-8.el10_2.5
This is the first release that contains the fix.
sudo dnf update openexrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or crafted EXR files until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The identified vulnerabilities in the OpenEXR package pose significant risks, including memory corruption and Denial of Service. It is crucial for users to update to the latest patched version to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for openexr →
FAQ
OpenEXR is an open-source image file format used for high-dynamic-range imaging, primarily in the visual effects and animation industries.
The vulnerabilities include memory corruption, out-of-bounds writes, and information disclosure, which can lead to Denial of Service attacks.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for the vulnerabilities in OpenEXR is 7.1, indicating a high severity level.
You can update the OpenEXR package by running the command 'sudo yum update openexr' in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
