RHSA-2026:84796HighCVSS 7.1

Red Hat Security Advisory: openexr security update

Published
October 19, 2026
Last Modified
October 19, 2026

🔗 CVE IDs covered (5)

CVE-2026-59981 →CVE-2026-59982 →CVE-2026-34544 →CVE-2026-59184 →CVE-2026-59189 →

📋 Description

CVE-2026-34544 — OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing CVE-2026-59184 — OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files CVE-2026-59189 — OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read CVE-2026-59981 — OpenEXR: OpenEXR: Information disclosure and denial of service via out-of-bounds read CVE-2026-59982 — OpenEXR: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file

🎯 Affected products39

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-0:3.1.10-8.el10_2.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-0:3.1.10-8.el10_2.5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-0:3.1.10-8.el10_2.5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-0:3.1.10-8.el10_2.5.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-0:3.1.10-8.el10_2.5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-debuginfo-0:3.1.10-8.el10_2.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-debuginfo-0:3.1.10-8.el10_2.5.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-debuginfo-0:3.1.10-8.el10_2.5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-debuginfo-0:3.1.10-8.el10_2.5.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-debuginfo-0:3.1.10-8.el10_2.5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-debuginfo-0:3.1.10-8.el10_2.5.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-debuginfo-0:3.1.10-8.el10_2.5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-debuginfo-0:3.1.10-8.el10_2.5.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-debugsource-0:3.1.10-8.el10_2.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-debugsource-0:3.1.10-8.el10_2.5.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-debugsource-0:3.1.10-8.el10_2.5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-debugsource-0:3.1.10-8.el10_2.5.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-debugsource-0:3.1.10-8.el10_2.5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-debugsource-0:3.1.10-8.el10_2.5.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-debugsource-0:3.1.10-8.el10_2.5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-debugsource-0:3.1.10-8.el10_2.5.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-devel-0:3.1.10-8.el10_2.5.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-devel-0:3.1.10-8.el10_2.5.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-devel-0:3.1.10-8.el10_2.5.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-devel-0:3.1.10-8.el10_2.5.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • openexr-libs-0:3.1.10-8.el10_2.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-libs-0:3.1.10-8.el10_2.5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • openexr-libs-0:3.1.10-8.el10_2.5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +9 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, avoid processing untrusted B44 or B44A EXR image files with applications linked against the OpenEXR library. Restricting the source of EXR files to trusted origins can reduce the risk of exploitation. Workaround: To mitigate this vulnerability, restrict the processing of EXR files to trusted sources only. Applications that use OpenEXR for writing image rows should avoid handling untrusted EXR files to prevent potential out-of-bounds write or use-after-free issues. Workaround: To mitigate this issue, avoid processing untrusted EXR deep image files. Limit the use of applications that process EXR deep images to trusted sources only. Workaround: To mitigate this issue, avoid processing untrusted or unverified EXR image files with applications linked against the OpenEXR library. Additionally, consider running applications that handle EXR files within a sandboxed environment to limit the potential impact of successful exploitation. Workaround: To mitigate this issue, avoid processing untrusted EXR image files with applications linked against OpenEXR. Users should exercise caution when handling EXR files from unknown or suspicious sources.

🔗 References (8)