Skip to content
Heist/ feed
UnratedFix available

Security update for openexr

Type: advisorySource: OSV1 source record

This update for openexr fixes the following issues: - CVE-2026-59183: unmapped memory access leading to crash due to `int32_t` multiplication overflow in `unpack_sample_table()` when decoding a crafted deep tiled EXR file (bsc#1276428). - CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero `dataWindow.min` (bsc#1276849). - CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public `TiledRgbaInputFile` RGBA API (bsc#1276850). - CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero `dataWindow` origin (bsc#1276855). - CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero `dataWindow` origin (bsc#1276862). - CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero `dataWindow` origin (bsc#1276853). - CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR (bsc#1276856). - CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR (bsc#1276857). - CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR (bsc#1276858). - CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty `multiView` header attribute (bsc#1276859). - CVE-2026-68515: heap out-of-bounds write in `exrmultiview` when combining two specially crafte

Announced Source revision 1
Original source ↗

SUSE-SU-2026:23604-1

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:SUSE-SU-2026:23604-1

openexr

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
3.2.2-160000.10.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

openexr

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
3.2.2-160000.10.1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.2.2-160000.10.1"
          }
        ]
      }
    ],
    "package": {
      "name": "openexr",
      "purl": "pkg:rpm/suse/openexr&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
      "ecosystem": "SUSE:Linux Enterprise Server 16.0"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23604-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "openexr": "3.2.2-160000.10.1",
          "openexr-doc": "3.2.2-160000.10.1",
          "libIex-3_2-31": "3.2.2-160000.10.1",
          "libOpenEXR-3_2-31": "3.2.2-160000.10.1",
          "libIlmThread-3_2-31": "3.2.2-160000.10.1",
          "libOpenEXRCore-3_2-31": "3.2.2-160000.10.1",
          "libOpenEXRUtil-3_2-31": "3.2.2-160000.10.1",
          "libIex-3_2-31-x86-64-v3": "3.2.2-160000.10.1",
          "libOpenEXR-3_2-31-x86-64-v3": "3.2.2-160000.10.1",
          "libIlmThread-3_2-31-x86-64-v3": "3.2.2-160000.10.1",
          "libOpenEXRCore-3_2-31-x86-64-v3": "3.2.2-160000.10.1",
          "libOpenEXRUtil-3_2-31-x86-64-v3": "3.2.2-160000.10.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.2.2-160000.10.1"
          }
        ]
      }
    ],
    "package": {
      "name": "openexr",
      "purl": "pkg:rpm/suse/openexr&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
      "ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23604-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "openexr": "3.2.2-160000.10.1",
          "openexr-doc": "3.2.2-160000.10.1",
          "libIex-3_2-31": "3.2.2-160000.10.1",
          "libOpenEXR-3_2-31": "3.2.2-160000.10.1",
          "libIlmThread-3_2-31": "3.2.2-160000.10.1",
          "libOpenEXRCore-3_2-31": "3.2.2-160000.10.1",
          "libOpenEXRUtil-3_2-31": "3.2.2-160000.10.1",
          "libIex-3_2-31-x86-64-v3": "3.2.2-160000.10.1",
          "libOpenEXR-3_2-31-x86-64-v3": "3.2.2-160000.10.1",
          "libIlmThread-3_2-31-x86-64-v3": "3.2.2-160000.10.1",
          "libOpenEXRCore-3_2-31-x86-64-v3": "3.2.2-160000.10.1",
          "libOpenEXRUtil-3_2-31-x86-64-v3": "3.2.2-160000.10.1"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#30875 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement