Homepage

Out-of-bounds Write Affecting openexr package, versions <3.4.14-0.1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.18% (8th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-OPENEXR-19270087
  • published26 Aug 2026
  • disclosed25 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 25 Aug 2026

NewCVE-2026-59984  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

Upgrade Debian:unstable openexr to version 3.4.14-0.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openexr package and not the openexr package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.