Openexr: Heap-buffer-overflow
Affects openexrSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in fffdcf2f0759a88a39a7ca302477666853a6e961, 3d53ed21cadb612e3b9828ccf116227e6a6ce21a
Data as of 4 Nov 2026, 18:06 UTC
What to do
Upgrade openexr to fffdcf2f0759a88a39a7ca302477666853a6e961 or 3d53ed21cadb612e3b9828ccf116227e6a6ce21a.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
OSS-Fuzzopenexrpkg:generic/openexrOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available and should be applied to affected OpenEXR versions. Users should update to the fixed versions corresponding to the commits fffdcf2f0759a88a39a7ca302477666853a6e961 and 3d53ed21cadb612e3b9828ccf116227e6a6ce21a to remediate this vulnerability.
Description
A heap-buffer-overflow vulnerability exists in the generic_unpack function of OpenEXR versions 3.3.4 through 3.4.2 and related release candidates. The issue was identified by OSS-Fuzz and involves an out-of-bounds read during pixel data processing. A patch is available to address this flaw.