The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, a crafted B44 or B44A EXR file can cause an out-of-bounds write in any application that decodes it via exr_decoding_run(). Consequences range from immediate crash (most likely) to corruption of adjacent heap allocations (layout-dependent). This issue has been patched in version 3.4.8.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openexr-devel | Oct 22, 2026 | Oct 21, 2026 |
| Alpine Linux | — | Upgrade openexr | Jun 18, 2026 | Apr 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade OpenEXR-libsUpgrade OpenEXRUpgrade OpenEXR-develUpgrade OpenEXR-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade openexr-develUpgrade openexr-debuginfoUpgrade openexrUpgrade openexr-debugsourceUpgrade openexr-libsUpgrade openexr-libs-debuginfo | Apr 14, 2026 | Apr 1, 2026 |
| Oracle_linux | — | Upgrade openexr-develUpgrade openexrUpgrade openexr-libs | Oct 22, 2026 | Apr 1, 2026 |
| Redhat_linux | — | No solution existsUpgrade openexr-develUpgrade openexrUpgrade openexr-libsUpgrade openexr-libs-debuginfoUpgrade openexr-debuginfoUpgrade openexr-debugsource | Jul 17, 2026 | Apr 1, 2026 |
| Rocky_linux | — | Upgrade openexr-debugsourceUpgrade openexr-debuginfoUpgrade openexr-libsUpgrade openexr-develUpgrade openexr-libs-debuginfoUpgrade openexr | Oct 22, 2026 | Oct 20, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub