Red Hat Security Advisory: OpenEXR security update

OpenEXR contains several security flaws involving out-of-bounds memory access triggered by crafted EXR files. Specifically, there are out-of-bounds write vulnerabilities (CVE-2026-59184, CVE-2026-59186, CVE-2026-68515) and out-of-bounds read vulnerabilities (CVE-2026-59189, CVE-2026-59981) that can cause information disclosure, denial of service, or heap corruption. These vulnerabilities affect the OpenEXR libraries and sample applications included in Red Hat Enterprise Linux 8 and related CodeReady Linux Builder products. Red Hat has released updated packages to fix these issues as detailed in advisory RHSA-2026:82345.

Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service, disclose sensitive information, or corrupt memory via specially crafted EXR image files. The impact is rated as important by Red Hat, indicating a high security risk but not necessarily critical system compromise. There are no known exploits in the wild at this time.

Red Hat has released security updates for OpenEXR in Red Hat Enterprise Linux 8 and related products. Users should apply the updated packages as described in Red Hat advisory RHSA-2026:82345 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.