The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openexr | Sep 2, 2026 | Aug 25, 2026 |
| Amazon_linux_2023 | — | Upgrade openexrUpgrade openexr-libsUpgrade openexr-debuginfoUpgrade openexr-libs-debuginfoUpgrade openexr-debugsourceUpgrade openexr-devel | Sep 30, 2026 | Aug 25, 2026 |
| Freebsd | — | Upgrade openexr | Aug 17, 2026 | Aug 14, 2026 |
| Redhat_linux | — | No solution exists | Sep 15, 2026 | Aug 25, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub