Skip to main content
VulnerabilityPublished Updated

Openexr: Heap-buffer-overflow

Affects openexrSource GCVE Database

0
Severity
High

Rated High by Threat Radar's AI analysis

Patch
Available – fixed in e56ec0701252841ab4c71271e7cc7101e568b8d6, ca2e5137d2e625bd050234df55171f8763c99a13

Data as of 27 Oct 2026, 00:23 UTC

What to do

Upgrade openexr to e56ec0701252841ab4c71271e7cc7101e568b8d6 or ca2e5137d2e625bd050234df55171f8763c99a13.

Affected software

ProductAffectedFixed in
OSS-Fuzzopenexrpkg:generic/openexrOther threatsAffected
  • v3.3.4 – v3.4.11-rc2
  • >=39b9d241cdcd4c95b7916992b8872d2620f9ac7a <ca2e5137d2e625bd050234df55171f8763c99a13
  • >=d948c6729c30cf15eaade9903ca0186d56a22d41 <e56ec0701252841ab4c71271e7cc7101e568b8d6
55 affected builds		Fixed in
  • ca2e5137d2e625bd050234df55171f8763c99a13
  • e56ec0701252841ab4c71271e7cc7101e568b8d6

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available and has been applied in fixed versions identified by the provided commit hashes. Users should upgrade to these fixed versions to remediate the vulnerability. No additional mitigation steps are indicated by the vendor or source.

Description

A heap-buffer-overflow vulnerability exists in the DwaCompressor_uncompress function of OpenEXR. This issue was identified by OSS-Fuzz and involves a write overflow during decompression. Multiple versions of OpenEXR 3.3.x are affected. A fix has been implemented in later versions.

References

Community reviews

Loading reviews…