CVE-2026-68516 OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the...

EUVD-2026-65178

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the...

CVE-2026-68516 OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the...

CVE-2026-68516 OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the...

The vulnerability of the internal_b44.c component of the image storage software for OpenEXR, which has a wide dynamic range of brightness levels, allows a hacker to cause a service failure.

The vulnerability of the internalb44.c component of the OpenEXR image storage software, which handles images with a wide dynamic range of brightness, is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-53532: Reachable Assertion

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exrstartread on untrusted input...

PT-2026-81065

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the...

CVE-2026-68516: Out-of-bounds Write

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the...

The vulnerability of the `CompositeDeepScanLine::readPixels` function in the ImfCompositeDeepScanLine component of image storage software for OpenEXR images with a wide dynamic range of brightness levels allows a hacker to cause a service failure.

The vulnerability of the CompositeDeepScanLine::readPixels function in the ImfCompositeDeepScanLine component of software for storing images with a wide dynamic range of brightness, OpenEXR, is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker ...

The vulnerability of the internal_piz.c component of the image storage software for OpenEXR, which has a wide dynamic range of brightness levels, allows a hacker to cause a service failure.

The vulnerability of the internalpiz.c component in the image storage software for OpenEXR, which supports a wide dynamic range of brightness values, is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause a system failure...

FreeBSD : OpenEXR -- 3.4.14 fixes multiple vulnerabilities (56449320-97c5-11f1-84d7-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 56449320-97c5-11f1-84d7-3c7c3fba4204 advisory. Cary Phillips reports: The OpenEXR 3.4.14 release addresses the following security...

OESA-2026-3286 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: When decoding an OpenEX...

OESA-2026-3285 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: When decoding an OpenEX...

OESA-2026-3284 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: When decoding an OpenEX...

OpenEXR -- 3.4.14 fixes multiple vulnerabilities

Cary Phillips reports: The OpenEXR 3.4.14 release addresses the following security vulnerabilities: CVE-2026-68514: PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow CVE-2026-68513: PyOpenEXR prefixed literal RGB key collision heap buffer overflow CVE-2026-62986: PyOpenEXR de...

MiracleLinux 9 : openexr-3.1.1-3.el9_8.3 (AXSA:2026-1493:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1493:05 advisory. OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing CVE-2026-41142 OpenEXR: OpenEXR: Information disclosure and denial...

OESA-2026-3208 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: When decoding an OpenEX...

OESA-2026-3209 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: When decoding an OpenEX...

OESA-2026-3210 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: When decoding an OpenEX...

JLSEC-2026-812 Heap buffer overflow when decoding a malicious HTJ2K-compressed EXR file

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, an integer overflow in htundoimpl in src/lib/OpenEXRCore/internalht.cpp leads to a heap-buffer overflow when decoding a crafted...