3238 matches found
GHSA-H762-RHV3-H25V vulnerabilities
Vulnerabilities for packages: openexr...
CVE-2026-34545 vulnerabilities
Vulnerabilities for packages: openexr...
CVE-2026-34544 vulnerabilities
Vulnerabilities for packages: openexr...
GHSA-VC68-257W-M432 vulnerabilities
Vulnerabilities for packages: openexr...
GHSA-Q6VJ-WXVF-5M8C vulnerabilities
Vulnerabilities for packages: openexr...
GHSA-Q6VJ-WXVF-5M8C vulnerabilities
Vulnerabilities for packages: openexr...
CVE-2026-34588
A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker could exploit an integer overflow vulnerability in the internalexrundopiz function by providing a specially crafted EXR file. This flaw leads to out-of-bounds reads and writes, which may allow...
CVE-2026-34589
A flaw was found in OpenEXR. The DWA lossy decoder, responsible for processing EXR image files, incorrectly handles large image widths. This occurs because temporary block pointers are constructed using signed 32-bit arithmetic, which can overflow. A remote attacker could exploit this by providin...
CVE-2026-34380
A flaw was found in OpenEXR, an image storage format library. A remote attacker could exploit a signed integer overflow vulnerability in the undopxr24impl function when processing a specially crafted EXR image file. This overflow can cause the application to write pixel data beyond its allocated...
EUVD-2026-7407
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp...
GHSA-Q6VJ-WXVF-5M8C OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
Summary A heap-buffer-overflow OOB read occurs in the istreamnonparallelread function in ImfContextInit.cpp when parsing a malformed EXR file through a memory-mapped IStream. A signed integer subtraction produces a negative value that is implicitly converted to sizet, resulting in a massive lengt...
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
Summary A heap-buffer-overflow OOB read occurs in the istreamnonparallelread function in ImfContextInit.cpp when parsing a malformed EXR file through a memory-mapped IStream. A signed integer subtraction produces a negative value that is implicitly converted to sizet, resulting in a massive lengt...
EUVD-2025-50826
OpenEXR has use after free in PyObjectStealAttrString...
OpenEXR has use after free in PyObject_StealAttrString
Summary There is a use-after-free in PyObjectStealAttrString of pyOpenEXRold.cpp. This bug was found with ZeroPath. Details The legacy adapter defines PyObjectStealAttrString that calls PyObjectGetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then...
GHSA-57CW-J6VP-2P9M OpenEXR has use after free in PyObject_StealAttrString
Summary There is a use-after-free in PyObjectStealAttrString of pyOpenEXRold.cpp. This bug was found with ZeroPath. Details The legacy adapter defines PyObjectStealAttrString that calls PyObjectGetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then...
GHSA-VH63-9MQX-WMJR OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
Summary A memory safety bug in the legacy OpenEXR Python adapter the deprecated OpenEXR.InputFile wrapper allow crashes and likely code execution when opening attacker-controlled EXR files or when passing crafted Python objects. Integer overflow and unchecked allocation in InputFile.channel and...
EUVD-2025-50827
OpenEXR has buffer overflow in PyOpenEXRold's channels and channel...
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
Summary A memory safety bug in the legacy OpenEXR Python adapter the deprecated OpenEXR.InputFile wrapper allow crashes and likely code execution when opening attacker-controlled EXR files or when passing crafted Python objects. Integer overflow and unchecked allocation in InputFile.channel and...
GHSA-3H9H-QFVW-98HQ OpenEXR Makes Use of Uninitialized Memory
Summary While fuzzing openexrexrcheckfuzzer, Valgrind reports a conditional branch depending on uninitialized data inside genericunpack. This indicates a use of uninitialized memory CWE-457. The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC. Details Environment: -...