Medium
Security advisory
An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-11765
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:53 UTC · Revision 1
Source evidence
An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read.
osv:CVE-2020-11765
Complete source record
{
"id": "849405f27f7acf23658be4673299eeda48c3d510cb4a8beda4ce9d37fe21cfa8",
"url": "https://osv.dev/vulnerability/CVE-2020-11765",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-11765",
"summary": "An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read.",
"evidence": "osv:CVE-2020-11765",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-11765",
"aliases": [
"CVE-2020-11765"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/AcademySoftwareFoundation/openexr",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0ca9b6e855d32a794874b1624581d68fcc3f87c0"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.4.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2.4.0",
"v2.4.0-beta.1",
"v2.3.0",
"v2.1.0",
"v2.0.1",
"v2.0.0.GM",
"v2.0.0",
"v1.7.1",
"OPENEXR_1_0_4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11765.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/academysoftwarefoundation/openexr",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0ca9b6e855d32a794874b1624581d68fcc3f87c0"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.4.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "0ca9b6e855d32a794874b1624581d68fcc3f87c0"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.4.1"
}
]
}
}
],
"versions": [
"v2.4.0",
"v2.4.0-beta.1",
"v2.3.0",
"v2.1.0",
"v2.0.1",
"v2.0.0.GM",
"v2.0.0",
"v1.7.1",
"OPENEXR_1_0_4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11765.json"
}
}
],
"modified": "2026-10-24T10:50:36.866038538Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4KFGDQG5PVYAU7TS5MZ7XCS6EMPVII3/",
"https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020",
"https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1",
"https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html",
"https://security.gentoo.org/glsa/202107-27",
"https://support.apple.com/kb/HT211288",
"https://support.apple.com/kb/HT211289",
"https://support.apple.com/kb/HT211290",
"https://support.apple.com/kb/HT211291",
"https://support.apple.com/kb/HT211293",
"https://support.apple.com/kb/HT211294",
"https://support.apple.com/kb/HT211295",
"https://usn.ubuntu.com/4339-1/",
"https://www.debian.org/security/2020/dsa-4755",
"https://bugs.chromium.org/p/project-zero/issues/detail?id=1987"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*"
],
"vendor_product": "apple:icloud",
"extracted_events": [
{
"range": [
{
"fixed": "7.20"
},
{
"introduced": "10.0"
},
{
"fixed": "11.3"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*"
],
"vendor_product": "apple:ipados",
"extracted_events": [
{
"range": [
{
"fixed": "13.6"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*"
],
"vendor_product": "apple:iphone_os",
"extracted_events": [
{
"range": [
{
"fixed": "13.6"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*"
],
"vendor_product": "apple:itunes",
"extracted_events": [
{
"range": [
{
"fixed": "12.10.8"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*"
],
"vendor_product": "apple:mac_os_x",
"extracted_events": [
{
"range": [
{
"introduced": "10.13.0"
},
{
"fixed": "10.13.6"
},
{
"introduced": "10.14.0"
},
{
"fixed": "10.14.6"
},
{
"introduced": "10.15"
},
{
"fixed": "10.15.6"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*"
],
"vendor_product": "apple:tvos",
"extracted_events": [
{
"range": [
{
"fixed": "13.4.8"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*"
],
"vendor_product": "apple:watchos",
"extracted_events": [
{
"range": [
{
"fixed": "6.2.8"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-001:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-002:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-003:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.13.6:supplemental_update:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*",
"cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*"
],
"vendor_product": "apple:mac_os_x",
"extracted_events": [
{
"range": [
{
"introduced": "10.13.6-NA"
},
{
"last_affected": "10.13.6-NA"
},
{
"introduced": "10.13.6-security_update_2018\\-002"
},
{
"last_affected": "10.13.6-security_update_2018\\-002"
},
{
"introduced": "10.13.6-security_update_2018\\-003"
},
{
"last_affected": "10.13.6-security_update_2018\\-003"
},
{
"introduced": "10.13.6-security_update_2019\\-001"
},
{
"last_affected": "10.13.6-security_update_2019\\-001"
},
{
"introduced": "10.13.6-security_update_2019\\-002"
},
{
"last_affected": "10.13.6-security_update_2019\\-002"
},
{
"introduced": "10.13.6-security_update_2019\\-003"
},
{
"last_affected": "10.13.6-security_update_2019\\-003"
},
{
"introduced": "10.13.6-security_update_2019\\-004"
},
{
"last_affected": "10.13.6-security_update_2019\\-004"
},
{
"introduced": "10.13.6-security_update_2019\\-005"
},
{
"last_affected": "10.13.6-security_update_2019\\-005"
},
{
"introduced": "10.13.6-security_update_2019\\-006"
},
{
"last_affected": "10.13.6-security_update_2019\\-006"
},
{
"introduced": "10.13.6-security_update_2019\\-007"
},
{
"last_affected": "10.13.6-security_update_2019\\-007"
},
{
"introduced": "10.13.6-security_update_2020\\-001"
},
{
"last_affected": "10.13.6-security_update_2020\\-001"
},
{
"introduced": "10.13.6-security_update_2020\\-002"
},
{
"last_affected": "10.13.6-security_update_2020\\-002"
},
{
"introduced": "10.13.6-security_update_2020\\-003"
},
{
"last_affected": "10.13.6-security_update_2020\\-003"
},
{
"introduced": "10.13.6-supplemental_update"
},
{
"last_affected": "10.13.6-supplemental_update"
},
{
"introduced": "10.14.6-NA"
},
{
"last_affected": "10.14.6-NA"
},
{
"introduced": "10.14.6-security_update_2019\\-001"
},
{
"last_affected": "10.14.6-security_update_2019\\-001"
},
{
"introduced": "10.14.6-security_update_2019\\-002"
},
{
"last_affected": "10.14.6-security_update_2019\\-002"
},
{
"introduced": "10.14.6-security_update_2019\\-004"
},
{
"last_affected": "10.14.6-security_update_2019\\-004"
},
{
"introduced": "10.14.6-security_update_2019\\-005"
},
{
"last_affected": "10.14.6-security_update_2019\\-005"
},
{
"introduced": "10.14.6-security_update_2019\\-006"
},
{
"last_affected": "10.14.6-security_update_2019\\-006"
},
{
"introduced": "10.14.6-security_update_2019\\-007"
},
{
"last_affected": "10.14.6-security_update_2019\\-007"
},
{
"introduced": "10.14.6-security_update_2020\\-001"
},
{
"last_affected": "10.14.6-security_update_2020\\-001"
},
{
"introduced": "10.14.6-security_update_2020\\-002"
},
{
"last_affected": "10.14.6-security_update_2020\\-002"
},
{
"introduced": "10.14.6-security_update_2020\\-003"
},
{
"last_affected": "10.14.6-security_update_2020\\-003"
},
{
"introduced": "10.14.6-supplemental_update"
},
{
"last_affected": "10.14.6-supplemental_update"
},
{
"introduced": "10.14.6-supplemental_update_2"
},
{
"last_affected": "10.14.6-supplemental_update_2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "19.10"
},
{
"last_affected": "19.10"
},
{
"introduced": "20.04"
},
{
"last_affected": "20.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "32"
},
{
"last_affected": "32"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-11765",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442349,
"published_at": "2020-04-14T23:15:12.56+00:00"
}