OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openexr-develUpgrade openexr-libsUpgrade openexr | Jul 14, 2026 | Jul 13, 2026 |
| Alpine Linux | — | Upgrade openexr | Jun 18, 2026 | May 7, 2026 |
| Amazon_linux_2023 | — | Upgrade openexr-debugsourceUpgrade openexr-debuginfoUpgrade openexr-libsUpgrade openexrUpgrade openexr-develUpgrade openexr-libs-debuginfo | May 28, 2026 | May 7, 2026 |
| Freebsd | — | Upgrade OpenEXR | May 4, 2026 | Apr 29, 2026 |
| Redhat_linux | — | Upgrade openexr-libs-debuginfoUpgrade openexr-libsUpgrade openexr-develUpgrade openexr-debugsourceUpgrade openexr-debuginfoUpgrade openexr | Jul 14, 2026 | May 7, 2026 |
| Rocky_linux | — | Upgrade openexr-develUpgrade openexr-debuginfoUpgrade openexr-libs-debuginfoUpgrade openexr-debugsourceUpgrade openexr-libsUpgrade openexr | Jul 16, 2026 | Jul 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub