SUSE CVE-2026-59985

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when ...

CVE-2026-59985

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when ...

CVE-2026-55371 OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes. The public setter validates the...

CVE-2026-55371

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes. The public setter validates the...

CVE-2026-55371 OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes. The public setter validates the...

EUVD-2026-65184

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes. The public setter validates the...

CVE-2026-55371: Improper Input Validation

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes. The public setter validates the...

OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size

SummaryThe OpenEXRCore code is vulnerable to a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header. DetailsWhen parsing STORAGEDEEPSCANLINE chunks from an EXR file, the following code from...

CVE-2026-44663: Integer Overflow or Wraparound

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, an integer overflow in htundoimpl in src/lib/OpenEXRCore/internalht.cpp leads to a heap-buffer overflow when decoding a crafted...

Fedora 44 : usd (2026-502486fc61)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-502486fc61 advisory. Backport several OpenEXRCore security fixes - Fixes CVE-2026-34378 / GHSA-v76p-4qvv-vh4g; closes RHBZ2455493 - Fixes CVE-2026-34380 /...

Fedora 43 : usd (2026-cde75a1416)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cde75a1416 advisory. Backport several OpenEXRCore security fixes - Fixes CVE-2026-34378 / GHSA-v76p-4qvv-vh4g; closes RHBZ2455493 - Fixes CVE-2026-34380 /...

PT-2026-35479

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a signed integer overflow exists in undo pxr24 impl in src/lib/OpenEXRCore/internal pxr24.c at line 377. T...

Fedora 45 : usd (2026-c0f8cde7ad)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c0f8cde7ad advisory. Automatic update for usd-26.03-3.fc45. Changelog Wed Apr 8 2026 Benjamin A. Beasley - 26.03-3 - Backport several OpenEXRCore security fixes - Fixes...

Fedora 45 : usd (2026-abd4c1829d)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-abd4c1829d advisory. Automatic update for usd-26.03-2.fc45. Changelog Mon Apr 6 2026 Benjamin A. Beasley - 26.03-2 - Backport fix for CVE-2026-34544 in OpenEXRCore - Fixes...

Fedora: Security Advisory (FEDORA-2025-4924a5bc8b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-447047dda8)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 42 : usd (2025-447047dda8)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-447047dda8 advisory. Backport fixes for CVE-2025-64181 etc. in OpenEXRCore Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Fedora 43 : usd (2025-4924a5bc8b)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-4924a5bc8b advisory. Backport fixes for CVE-2025-64181 etc. in OpenEXRCore Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...