Skip to main content
VulnerabilityPublished

Openexr: UNKNOWN READ

Affects openexrSource GCVE Database

0
Severity
Medium

Rated Medium by Threat Radar's AI analysis

Patch
Available – fixed in e9e9fefc429904f412699199a5264bcba1e655ec

Data as of 10 Nov 2026, 13:22 UTC

What to do

Upgrade openexr to e9e9fefc429904f412699199a5264bcba1e655ec.

Affected software

ProductAffectedFixed in
OSS-Fuzzopenexrpkg:generic/openexrOther threatsAffected
  • v3.5.0 – v3.5.3-rc
  • >=d2b07b19423a9c595644956f199f0f4168e8c5cd <e9e9fefc429904f412699199a5264bcba1e655ec
8 affected builds		Fixed in
  • e9e9fefc429904f412699199a5264bcba1e655ec

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Apply the available patch that fixes this issue, as indicated by the fixed commit e9e9fefc429904f412699199a5264bcba1e655ec. Users should upgrade affected OpenEXR versions to the patched release to prevent crashes related to this vulnerability.

Description

A vulnerability in OpenEXR versions 3.5.0 through 3.5.3 and their release candidates causes an UNKNOWN READ crash in the destructor of ojph::local::param_nlt. This issue was identified by OSS-Fuzz and results in a crash during object destruction.

References

Community reviews

Loading reviews…