The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application writes rows through FlatHalfChannel::row(). Affected consumers are tools, converters, render pipeline components, or image-processing services that accept untrusted EXR files and use FlatHalfChannel::row() on loaded images. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openexr-libsUpgrade openexr-devel | Oct 14, 2026 | Oct 13, 2026 |
| Alpine Linux | — | Upgrade openexr | Sep 2, 2026 | Aug 25, 2026 |
| Amazon_linux_2023 | — | Upgrade openexr-libsUpgrade openexr-debuginfoUpgrade openexr-develUpgrade openexr-libs-debuginfoUpgrade openexrUpgrade openexr-debugsource | Sep 30, 2026 | Aug 25, 2026 |
| Freebsd | — | Upgrade openexr | Aug 17, 2026 | Aug 14, 2026 |
| Oracle_linux | — | Upgrade openexr-develUpgrade openexr-libs | Oct 22, 2026 | Aug 25, 2026 |
| Redhat_linux | — | Upgrade openexr-debugsourceUpgrade openexr-libs-debuginfoUpgrade openexr-debuginfoUpgrade openexrUpgrade openexr-develUpgrade openexr-libs | Sep 21, 2026 | Aug 25, 2026 |
| Rocky_linux | — | Upgrade openexr-debuginfoUpgrade openexr-libsUpgrade openexrUpgrade openexr-libs-debuginfoUpgrade openexr-develUpgrade openexr-debugsource | Oct 16, 2026 | Oct 14, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub