Red Hat Security Advisory: openexr security update

OpenEXR contains multiple security flaws including memory corruption and denial of service via crafted EXR file processing (CVE-2026-34544), denial of service or information disclosure via crafted EXR image files (CVE-2026-59982), out-of-bounds write vulnerability (CVE-2026-59184), and out-of-bounds read vulnerabilities leading to information disclosure and denial of service (CVE-2026-59189, CVE-2026-59981). These vulnerabilities arise from improper handling of crafted EXR files and can lead to crashes, memory corruption, or unauthorized information disclosure. Red Hat has released security updates for OpenEXR in Red Hat Enterprise Linux 9 and related variants to remediate these issues. The advisory references multiple CVEs and provides updated package versions to mitigate the risks.

Successful exploitation of these vulnerabilities could result in memory corruption, denial of service conditions, or information disclosure when processing maliciously crafted EXR image files. This could impact applications relying on OpenEXR for image processing, potentially causing crashes or exposing sensitive information. The vulnerabilities affect multiple architectures supported by Red Hat Enterprise Linux 9. No known exploits in the wild have been reported at this time.

Red Hat has released updated OpenEXR packages for Red Hat Enterprise Linux 9 and related products that address these vulnerabilities. Users should apply the security updates as described in the Red Hat advisory RHSA-2026:86983 (https://access.redhat.com/errata/RHSA-2026:86983) and the update instructions at https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.