AcademySoftwareFoundation openexr
47 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-59981 | < 3.2.11 ; >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow | HIGH 7.1 | 0.3 % | ||
| CVE-2026-68514 | >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-68515 | >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 ; < 3.2.11 | OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union | HIGH 7.1 | 0.2 % | ||
| CVE-2026-68513 | >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision | HIGH 7.1 | 0.2 % | ||
| CVE-2026-65979 | >= 3.4.0, < 3.4.13 | OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN) | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-62986 | >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-61555 | < 3.2.11 ; >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: Empty multiView viewFromChannelName file crash | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-59985 | >= 3.2.0, < 3.2.11 ; >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32 | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-59984 | >= 3.1.0, < 3.2.11 ; >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32 | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-59983 | < 3.2.11 ; >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32 | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-59982 | >= 3.1.0, < 3.2.11 ; >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms | HIGH 7.1 | 0.3 % | ||
| CVE-2026-59189 | < 3.2.11 ; >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin | HIGH 7.1 | 0.3 % | ||
| CVE-2026-59187 | >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: exrmetrics deep pixelmode heap buffer overflow | HIGH 7.1 | 0.4 % | ||
| CVE-2026-59186 | < 3.2.11 ; >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds | HIGH 7.1 | 0.3 % | ||
| CVE-2026-59184 | < 3.2.11 ; >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write | HIGH 7.1 | 0.2 % | ||
| CVE-2026-59183 | >= 3.1.0, < 3.2.11 ; >= 3.3.0, < 3.3.13 ; >= 3.4.0, < 3.4.14 | OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-55373 | < 3.2.10 ; >= 3.3.0, < 3.3.12 ; >= 3.4.0, < 3.4.13 | OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-55371 | >= 3.4.0, < 3.4.13 | OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-55059 | < 3.2.10 ; >= 3.3.0, < 3.3.12 ; >= 3.4.0, < 3.4.13 | OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-54920 | < 3.2.10 ; >= 3.3.0, <= 3.3.12 ; >= 3.4.0, <= 3.4.13 | OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize | NONE 0.0 | 0.4 % | ||
| CVE-2026-53532 | >= 3.4.0, < 3.4.13 | OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) | HIGH 7.1 | 0.4 % | ||
| CVE-2026-68516 | >= 3.4.0, < 3.4.14 | OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-45696 | >= 3.4.0, < 3.4.11 | OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS) | HIGH 8.3 | 0.4 % | ||
| CVE-2026-44663 | >= 3.4.0, < 3.4.11 | OpenEXR: Integer overflow in the HTJ2K decoder leads to heap-buffer-overflow | HIGH 7.1 | 0.2 % | ||
| CVE-2026-42217 | >= 3.0.0, < 3.2.9 ; >= 3.3.0, < 3.3.11 ; >= 3.4.0, < 3.4.11 | OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`) | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-42216 | >= 3.0.0, < 3.2.9 ; >= 3.3.0, < 3.3.11 ; >= 3.4.0, < 3.4.11 | OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion | HIGH 8.8 | 0.5 % | ||
| CVE-2026-41142 | >= 3.0.0, < 3.2.9 ; >= 3.3.0, < 3.3.11 ; >= 3.4.0, < 3.4.11 | OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API | HIGH 8.8 | 0.4 % | ||
| CVE-2026-40250 | >= 3.2.0, < 3.2.8 ; >= 3.3.0, < 3.3.10 ; >= 3.4.0, < 3.4.10 | OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589) | HIGH 8.4 | 0.4 % | ||
| CVE-2026-40244 | >= 3.2.0, < 3.2.8 ; >= 3.3.0, < 3.3.10 ; >= 3.4.0, < 3.4.10 | OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589) | HIGH 8.4 | 0.4 % | ||
| CVE-2026-39886 | >= 3.4.0, < 3.4.10 | OpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl() | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-34589 | >= 3.2.0, < 3.2.7 ; >= 3.3.0, < 3.3.9 ; >= 3.4.0, < 3.4.9 | OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write | HIGH 8.4 | 0.4 % | ||
| CVE-2026-34588 | >= 3.1.0, <= 3.1.13 ; >= 3.2.0, < 3.2.7 ; >= 3.3.0, < 3.3.9 ; … | OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write | HIGH 8.6 | 0.5 % | ||
| CVE-2026-34380 | >= 3.2.0, < 3.2.7 ; >= 3.3.0, < 3.3.9 ; >= 3.4.0, < 3.4.9 | OpenEXR has a signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-34379 | >= 3.2.0, < 3.2.7 ; >= 3.3.0, < 3.3.9 ; >= 3.4.0, < 3.4.9 | OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression) | HIGH 7.1 | 0.3 % | ||
| CVE-2026-34378 | >= 3.4.0, < 3.4.9 | OpenEXR has a signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-34543 | >= 3.4.0, < 3.4.8 | OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl) | HIGH 8.7 | 0.5 % | ||
| CVE-2026-34544 | >= 3.4.0, < 3.4.8 | OpenEXR: integer overflow to OOB write in uncompress_b44_impl() | HIGH 8.4 | 0.3 % | ||
| CVE-2026-34545 | >= 3.4.0, < 3.4.7 | OpenEXR: integer overflow lead to OOB in HTJ2K decoder | HIGH 8.4 | 0.6 % | ||
| CVE-2026-27622 | >= 2.3.0, < 3.2.6 ; >= 3.3.0, < 3.3.8 ; >= 3.4.0, < 3.4.6 | OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write | HIGH 8.4 | 0.2 % | ||
| CVE-2026-26981 | >= 3.3.0, < 3.3.7 ; >= 3.4.0, < 3.4.5 | OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp | MEDIUM 6.5 | 0.6 % | ||
| CVE-2025-64183 | >= 3.2.0, < 3.2.5 ; >= 3.3.0, < 3.3.6 ; >= 3.4.0, < 3.4.3 | OpenEXR has use after free in PyObject_StealAttrString | MEDIUM 5.5 | 0.3 % | ||
| CVE-2025-64182 | >= 3.2.0, < 3.2.5 ; >= 3.3.0, < 3.3.6 ; >= 3.4.0, < 3.4.3 | OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel() | MEDIUM 5.5 | 0.3 % | ||
| CVE-2025-64181 | >= 3.3.0, < 3.3.6 ; >= 3.4.0, < 3.4.3 | OpenEXR Makes Use of Uninitialized Memory | LOW 2.0 | 0.4 % | ||
| CVE-2025-48074 | >= 3.3.2, < 3.3.3 | OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors | MEDIUM 4.6 | 0.3 % | ||
| CVE-2025-48073 | >= 3.3.2, < 3.3.3 | OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode | MEDIUM 4.6 | 0.2 % | ||
| CVE-2025-48072 | >= 3.3.2, < 3.3.3 | OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap | MEDIUM 6.8 | 0.6 % | ||
| CVE-2025-48071 | >= 3.3.0, < 3.3.3 | OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline Parsing | HIGH 8.4 | 0.4 % |