The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openexr-devel | Oct 22, 2026 | Oct 21, 2026 |
| Alpine Linux | — | Upgrade openexr | Sep 2, 2026 | Aug 25, 2026 |
| Amazon_linux_2023 | — | Upgrade openexr-debuginfoUpgrade openexr-libsUpgrade openexr-debugsourceUpgrade openexrUpgrade openexr-develUpgrade openexr-libs-debuginfo | Sep 30, 2026 | Aug 25, 2026 |
| Freebsd | — | Upgrade openexr | Aug 17, 2026 | Aug 14, 2026 |
| Redhat_linux | — | Upgrade openexrUpgrade openexr-debugsourceUpgrade openexr-libs-debuginfoUpgrade openexr-debuginfoUpgrade openexr-develUpgrade openexr-libs | Sep 21, 2026 | Aug 25, 2026 |
| Rocky_linux | — | Upgrade openexr-libsUpgrade openexr-libs-debuginfoUpgrade openexr-debuginfoUpgrade openexrUpgrade openexr-debugsourceUpgrade openexr-devel | Oct 22, 2026 | Oct 20, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub