OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application writes rows through FlatHalfChannel::row(). Affected consumers are tools, converters, render pipeline components, or image-processing services that accept untrusted EXR files and use FlatHalfChannel::row() on loaded images. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openexr-develUpgrade openexr-libs | Oct 14, 2026 | Oct 13, 2026 |
| Alpine Linux | — | Upgrade openexr | Sep 2, 2026 | Aug 25, 2026 |
| Amazon_linux_2023 | — | Upgrade openexr-debugsourceUpgrade openexrUpgrade openexr-libs-debuginfoUpgrade openexr-debuginfoUpgrade openexr-develUpgrade openexr-libs | Sep 30, 2026 | Aug 25, 2026 |
| Freebsd | — | Upgrade openexr | Aug 17, 2026 | Aug 14, 2026 |
| Oracle_linux | — | Upgrade openexr-libsUpgrade openexr-devel | Oct 22, 2026 | Aug 25, 2026 |
| Redhat_linux | — | Upgrade openexr-libs-debuginfoUpgrade openexr-debuginfoUpgrade openexrUpgrade openexr-debugsourceUpgrade openexr-develUpgrade openexr-libs | Sep 21, 2026 | Aug 25, 2026 |
| Rocky_linux | — | Upgrade openexr-develUpgrade openexr-debugsourceUpgrade openexrUpgrade openexr-libsUpgrade openexr-libs-debuginfoUpgrade openexr-debuginfo | Oct 16, 2026 | Oct 14, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub