CVE-2026-55059 OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf40::SampleCountChannel::setint r, unsigned int newNumSamples. The row-based...

CVE-2026-55059

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf40::SampleCountChannel::setint r, unsigned int newNumSamples. The row-based...

CVE-2026-55059

OpenEXR (the reference implementation for the EXR deep image format) versions prior to 3.2.10, 3.3.12, and 3.4.13 contain a heap out-of-bounds write in Imf_4_0::SampleCountChannel::set(). The root cause is that the row-based sample-count setter computes the target Y coordinate using dataWindow.mi...

CVE-2026-55059

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf40::SampleCountChannel::setint r, unsigned int newNumSamples. The row-based...

CVE-2026-55059 OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf40::SampleCountChannel::setint r, unsigned int newNumSamples. The row-based...

CVE-2026-54920 OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

CVE-2026-54920 OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

CVE-2026-54920 OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

CVE-2026-54920

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

CVE-2026-54920

OpenEXR (reference implementation for the EXR image format, widely used in the motion picture industry) versions 3.4.0 through 3.4.12 contain a denial of service vulnerability in the HTJ2K decode path . A crafted HTJ2K-compressed EXR file with a QCD marker whose lower five bits are zero is passed...

EUVD-2026-65182

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

CVE-2026-54920

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

CVE-2026-55373: Integer Overflow or Wraparound

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an infinite-loop vulnerability in SampleCountChannel. The helper roundListSizeUp rounds a sample-list size up to the...

CVE-2026-65979: Improper Input Validation

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field PLEN from a chunk's compressed data but never checks that this value fits within the...

CVE-2026-59981: Out-of-bounds Read

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::ro...

CVE-2026-62986: Exposure of Sensitive Information to an Unauthorized Actor

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap data when reading a crafted deep scanline EXR that uses...

CVE-2026-59982: Integer Overflow or Wraparound

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row when a crafted deep EX...

CVE-2026-59984: Out-of-bounds Write

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted...

CVE-2026-59183: Integer Overflow or Wraparound

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, an int32t multiplication in OpenEXRCore's unpacksampletable can overflow while decoding...

PT-2026-81398

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description A crafted EXR file with a nonzero dataWindow.min can cause the TypedFlatImageChannel::row function to return an invalid he...