SB2026041307 - Red Hat Enterprise Linux 10 update for openexr
Published: April 13, 2026
Security Bulletin ID
SB2026041307
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Integer overflow (CVE-ID: CVE-2026-27622)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to integer overflow in CompositeDeepScanLine::readPixels when parsing a crafted multipart deep EXR file. A remote attacker can supply a specially crafted file to execute arbitrary code.
User interaction is required to open or process the crafted file through multipart deep read flows using MultiPartInputFile, DeepScanLineInputPart, and CompositeDeepScanLine.
Remediation
Install update from vendor's website.