Security update for openexr
This update for openexr fixes the following issues: - CVE-2026-59183: unmapped memory access leading to crash due to `int32_t` multiplication overflow in `unpack_sample_table()` when decoding a crafted deep tiled EXR file (bsc#1276428). - CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero `dataWindow.min` (bsc#1276849). - CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public `TiledRgbaInputFile` RGBA API (bsc#1276850). - CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero `dataWindow` origin (bsc#1276855). - CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero `dataWindow` origin (bsc#1276862). - CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero `dataWindow` origin (bsc#1276853). - CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR (bsc#1276856). - CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR (bsc#1276857). - CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR (bsc#1276858). - CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty `multiView` header attribute (bsc#1276859). - CVE-2026-68515: heap out-of-bounds write in `exrmultiview` when combining two specially crafted, individually valid scanline EXR files whose union `dataWindow` is not aligned to one view's channel subsampling (bsc#1276848).
Security update for openexr
Description
This update for openexr fixes the following issues: - CVE-2026-59183: unmapped memory access leading to crash due to `int32_t` multiplication overflow in `unpack_sample_table()` when decoding a crafted deep tiled EXR file (bsc#1276428). - CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero `dataWindow.min` (bsc#1276849). - CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public `TiledRgbaInputFile` RGBA API (bsc#1276850). - CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero `dataWindow` origin (bsc#1276855). - CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero `dataWindow` origin (bsc#1276862). - CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero `dataWindow` origin (bsc#1276853). - CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR (bsc#1276856). - CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR (bsc#1276857). - CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR (bsc#1276858). - CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty `multiView` header attribute (bsc#1276859). - CVE-2026-68515: heap out-of-bounds write in `exrmultiview` when combining two specially crafted, individually valid scanline EXR files whose union `dataWindow` is not aligned to one view's channel subsampling (bsc#1276848).
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- SUSE Product Security Team
- Advisory Id
- openSUSE-SU-2026:21737-1
- Cve Count
- 11
- Additional Cves
- ["CVE-2026-59184","CVE-2026-59186","CVE-2026-59189","CVE-2026-59981","CVE-2026-59982","CVE-2026-59983","CVE-2026-59984","CVE-2026-59985","CVE-2026-61555","CVE-2026-68515"]
Threat ID: 6aab495c55bf5e2cf5990ae1
Added to database: 09/17/2026, 01:58:52 UTC
Last updated: 09/17/2026, 01:58:52 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.