CVE-2025-48072: Out-of-bounds Read

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR...

OpenEXR 缓冲区错误漏洞

OpenEXR is an open standard for high dynamic range image HDR file formats. A buffer overflow vulnerability exists in OpenEXR version 3.3.2, which stems from incorrect pointer arithmetic leading to an out-of-bounds read operation when decompressing a DWAA compressed scanline EXR file with...

NewStart CGSL MAIN 7.02 : OpenEXR Multiple Vulnerabilities (NS-SA-2025-0107)

The remote NewStart CGSL host, running version MAIN 7.02, has OpenEXR packages installed that are affected by multiple vulnerabilities: - Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing...

TencentOS Server 4: openexr (TSSA-2024:0629)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0629 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CLSA-2025-1749743322 openexr: Fix of CVE-2023-5841

CVE-2023-5841: fix heap-based buffer overflow vulnerability...

CVE-2024-31047

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service DoS via the convert function of exrmultipart.cpp...

CVE-2023-50245

OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed in version 0.6.1...

CVE-2020-19490

tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code...

Heap Based Buffer Overflow

openexr is vulnerable to a heap-based buffer overflow. The vulnerability is due to bad pointer math during decompression of DWAA-packed scan-line EXR files with a maliciously forged chunk, which allows an attacker to trigger memory corruption and potentially execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2021-3474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in the FastHufDecoder,...

Linux Distros Unpatched Vulnerability : CVE-2021-3933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow could occur when OpenEXR processes a crafted file on systems where sizet 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLi...

Linux Distros Unpatched Vulnerability : CVE-2021-3476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could...

Linux Distros Unpatched Vulnerability : CVE-2021-3941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In ImfChromaticities.cpp routine RGBtoXYZ, there are some division operations such as float Z = 1 - chroma.white.x - chroma.white.y Y / chroma.white.y; and...

Linux Distros Unpatched Vulnerability : CVE-2021-3479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEX...

Linux Distros Unpatched Vulnerability : CVE-2021-3598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an applicatio...

Linux Distros Unpatched Vulnerability : CVE-2023-5841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing...

Linux Distros Unpatched Vulnerability : CVE-2021-3477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed b...

Linux Distros Unpatched Vulnerability : CVE-2021-45942

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf31::LineCompositeTask::execute called from IlmThread31::NullThreadPoolProvider::addTask and...

Linux Distros Unpatched Vulnerability : CVE-2021-3475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer overflow,...

Linux Distros Unpatched Vulnerability : CVE-2021-3605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked wi...