SUSE-SU-2026:3169-1
SUSE-SU-2026:3169-1 · Security update for openexr
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for openexr fixes the following issues - CVE-2026-54920: unchecked integer overflows in Image::resize() followed by an exception can lead to an invalid delete via uninitialized pointers (bsc#1269703). - CVE-2026-55059: row setter utilizing dataWindow.min.x instead of min.y can lead to a heap out-of-bounds write (bsc#1269702). - CVE-2026-55373: integer overflow in roundListSizeUp() wrapping a 32-bit unsigned value to zero can lead to an infinite loop (bsc#1269701).
Fix available
- Published
- Updated
Stack: system
Affected products and versions
openexr SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
- Affected ranges
- ECOSYSTEM: < 2.2.1-150000.3.52.1
Update to 2.2.1-150000.3.52.1
Original sources
- https://www.suse.com/support/update/announcement/2026/suse-su-20263169-1/
- https://bugzilla.suse.com/1269701
- https://bugzilla.suse.com/1269702
- https://bugzilla.suse.com/1269703
- https://www.suse.com/security/cve/CVE-2026-54920
- https://www.suse.com/security/cve/CVE-2026-55059
- https://www.suse.com/security/cve/CVE-2026-55373
- https://osv.dev/vulnerability/SUSE-SU-2026:3169-1