PatchFirst · Latest vulnerabilities
Vulnerability published for openexr in the last 30 days: 1. Listed in the KEV catalogue: 0.
Vulnerabilities: 3
This update for openexr fixes the following issue: - CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file containing an unknown-type attribute with dataSize set to zero is processed (bsc#1282700).
This update for openexr fixes the following issues: - CVE-2026-59184: invalid heap pointer, causing out-of-bounds or use-after-free writes (bsc#1276849). - CVE-2026-59186: On ILP32, the Array2D<Rgba> tile-conversion buffer size calculation overflows, allocates a much smaller heap buffer, and tile decode writes past that allocation (bsc#1276850). - CVE-2026-59189: API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin, resulting in a heap out-of-bounds read and crash, with potential information disclosure under a controlled heap layout (bsc#1276855). - CVE-2026-59981: an attacker-controlled deep EXR f
This update for openexr fixes the following issues - CVE-2026-54920: unchecked integer overflows in Image::resize() followed by an exception can lead to an invalid delete via uninitialized pointers (bsc#1269703). - CVE-2026-55059: row setter utilizing dataWindow.min.x instead of min.y can lead to a heap out-of-bounds write (bsc#1269702). - CVE-2026-55373: integer overflow in roundListSizeUp() wrapping a 32-bit unsigned value to zero can lead to an infinite loop (bsc#1269701).
Check your installed stack and versions against the current vulnerability feeds.