Critical Memory Corruption and Denial of Service Vulnerabilities in OpenEXR Package
Summary
RLSA-2026:86983: Important: openexr security update. Affects openexr versions < 0:3.1.1-3.el9_8.5. Fixed in 0:3.1.1-3.el9_8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenEXR is an open-source high-dynamic-range floating-point image file format designed for high-quality image processing and storage. It is widely used in visual effects and animation due to its ability to handle complex image data. However, recent vulnerabilities have been identified that could compromise the integrity and availability of systems using this package.
Vulnerability Detail
The vulnerabilities in OpenEXR stem from improper handling of crafted EXR files, leading to memory corruption, denial of service, and potential information disclosure. Specifically, issues include out-of-bounds writes and reads that can be exploited by malicious users to crash applications or expose sensitive information. The vulnerabilities are tracked under multiple CVEs, including CVE-2026-34544, CVE-2026-59184, CVE-2026-59189, CVE-2026-59981, and CVE-2026-59982, with a CVSS score of 7.1 indicating a high severity level.
How To Fix
Minimum fixed version
0:3.1.1-3.el9_8.5
This is the first release that contains the fix.
sudo dnf update openexrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to applications that utilize OpenEXR files or validating EXR files before processing them to mitigate the risk of exploitation.
Conclusion
The identified vulnerabilities in the OpenEXR package pose significant risks, including memory corruption and denial of service. It is crucial for users to update to the latest patched version to mitigate these risks effectively. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in open-source software.
See every vulnerability recorded for openexr →
FAQ
OpenEXR is an open-source image file format used for high-dynamic-range imaging, primarily in visual effects and animation.
Vulnerabilities include memory corruption, denial of service, and information disclosure due to improper handling of crafted EXR files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without requiring signup.
The vulnerabilities have a CVSS score of 7.1, indicating a high severity level.
Consider implementing access restrictions to applications using OpenEXR files and validate EXR files before processing to reduce risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
