RHSA-2026:82345HighCVSS 7.1

Red Hat Security Advisory: OpenEXR security update

Published
October 13, 2026
Last Modified
October 13, 2026

🔗 CVE IDs covered (5)

CVE-2026-59184 →CVE-2026-59186 →CVE-2026-59189 →CVE-2026-59981 →CVE-2026-68515 →

📋 Description

CVE-2026-59184 — OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files CVE-2026-59186 — OpenEXR: OpenEXR: Heap out-of-bounds write via crafted tiled EXR file CVE-2026-59189 — OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read CVE-2026-59981 — OpenEXR: OpenEXR: Information disclosure and denial of service via out-of-bounds read CVE-2026-68515 — OpenEXR: OpenEXR: Heap out-of-bounds write in exrmultiview via crafted EXR files

🎯 Affected products43

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-0:2.2.0-12.el8_10.3.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debuginfo-0:2.2.0-12.el8_10.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debuginfo-0:2.2.0-12.el8_10.3.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-debuginfo-0:2.2.0-12.el8_10.3.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debuginfo-0:2.2.0-12.el8_10.3.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-debuginfo-0:2.2.0-12.el8_10.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debuginfo-0:2.2.0-12.el8_10.3.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-debuginfo-0:2.2.0-12.el8_10.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debuginfo-0:2.2.0-12.el8_10.3.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-debuginfo-0:2.2.0-12.el8_10.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debuginfo-0:2.2.0-12.el8_10.3.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-debugsource-0:2.2.0-12.el8_10.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debugsource-0:2.2.0-12.el8_10.3.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-debugsource-0:2.2.0-12.el8_10.3.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debugsource-0:2.2.0-12.el8_10.3.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-debugsource-0:2.2.0-12.el8_10.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debugsource-0:2.2.0-12.el8_10.3.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-debugsource-0:2.2.0-12.el8_10.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debugsource-0:2.2.0-12.el8_10.3.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-debugsource-0:2.2.0-12.el8_10.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-debugsource-0:2.2.0-12.el8_10.3.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-devel-0:2.2.0-12.el8_10.3.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-devel-0:2.2.0-12.el8_10.3.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-devel-0:2.2.0-12.el8_10.3.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-devel-0:2.2.0-12.el8_10.3.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-devel-0:2.2.0-12.el8_10.3.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • OpenEXR-libs-0:2.2.0-12.el8_10.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • OpenEXR-libs-0:2.2.0-12.el8_10.3.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +13 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, restrict the processing of EXR files to trusted sources only. Applications that use OpenEXR for writing image rows should avoid handling untrusted EXR files to prevent potential out-of-bounds write or use-after-free issues. Workaround: To mitigate this issue, avoid processing untrusted or unverified EXR image files with applications linked against OpenEXR, particularly on 32-bit/ILP32 systems. Additionally, consider running applications that process EXR files in a sandboxed environment to limit potential impact from successful exploitation. Workaround: To mitigate this issue, avoid processing untrusted EXR deep image files. Limit the use of applications that process EXR deep images to trusted sources only. Workaround: To mitigate this issue, avoid processing untrusted or unverified EXR image files with applications linked against the OpenEXR library. Additionally, consider running applications that handle EXR files within a sandboxed environment to limit the potential impact of successful exploitation. Workaround: To mitigate this issue, avoid processing untrusted or unverified EXR image files with the `exrmultiview` utility. Users should exercise caution when handling EXR files from unknown or suspicious sources. If possible, restrict the execution environment of `exrmultiview` through sandboxing mechanisms to limit potential impact.

🔗 References (8)