SB20261111137 - Debian update for openexr
Published: November 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 26 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-55059)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in Imf_4_0::SampleCountChannel::set(int r, unsigned int newNumSamples[]) when processing row-based sample-count updates through the OpenEXRUtil DeepImage API. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
User interaction is required, and exploitation requires image data windows whose X and Y origins differ.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-68515)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or corrupt memory.
The vulnerability exists due to a heap-based buffer overflow in the exrmultiview utility when processing two attacker-supplied scanline EXR files whose combined data window is not aligned to a view's channel subsampling. A remote attacker can supply crafted EXR inputs to trigger a heap out-of-bounds write and cause a denial of service or corrupt memory.
User interaction is required to open or process the crafted EXR files.
3) Out-of-bounds read (CVE-ID: CVE-2026-61555)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in viewFromChannelName() when parsing a crafted EXR file with an empty multiView header attribute. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
User interaction is required to open or process a crafted EXR file.
4) Out-of-bounds read (CVE-ID: CVE-2026-59985)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the OpenEXRCore RLE scanline decode path when parsing a crafted RLE-compressed EXR file on ILP32 builds. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
Only 32-bit/ILP32 builds are demonstrated to be vulnerable, and user interaction is required to open the crafted file.
5) Out-of-bounds write (CVE-ID: CVE-2026-59984)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the B44 scanline decode path reached through the public C++ Imf::InputFile::readPixels() API when parsing a crafted B44-compressed scanline EXR file on 32-bit ILP32 builds. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
Only 32-bit ILP32 builds are affected, and user interaction is required to open the crafted EXR file.
6) Out-of-bounds read (CVE-ID: CVE-2026-59983)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in OpenEXRCore deep sample-count decoding and DeepTiledInputFile::readPixelSampleCounts() when parsing a crafted deep-tiled EXR file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
Only 32-bit ILP32 builds are affected, and user interaction is required to open the crafted file.
7) Out-of-bounds write (CVE-ID: CVE-2026-59982)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the DWAA scanline decode path reachable via the public C++ Imf::InputFile::readPixels() API when parsing a crafted DWAA-compressed scanline EXR file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
Only 32-bit ILP32 builds are affected; user interaction is required to open the crafted EXR file, and the issue was not demonstrated on LP64 builds.
8) Out-of-bounds read (CVE-ID: CVE-2026-59981)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.
The vulnerability exists due to out-of-bounds read in the OpenEXRUtil SampleCountChannel::row() API when parsing a crafted deep EXR image with a non-zero dataWindow origin. A remote attacker can trick the victim into opening a crafted file to cause a denial of service and disclose sensitive information.
User interaction is required to open a crafted file.
9) Out-of-bounds read (CVE-ID: CVE-2026-59189)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in TypedDeepImageChannel<T>::row(row) in OpenEXRUtil when parsing a crafted deep EXR file with a non-zero dataWindow origin. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
The issue can also lead to potential information disclosure when surrounding heap layout makes the out-of-bounds pointer array entry application-observable.
10) Heap-based buffer overflow (CVE-ID: CVE-2026-59186)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow leading to a heap-based buffer overflow in the TiledRgbaInputFile RGBA API when parsing a crafted tiled EXR file. A remote attacker can supply a specially crafted tiled EXR file to cause a denial of service.
Only 32-bit/ILP32 builds are vulnerable, and user interaction is required to open or process the crafted file.
11) Out-of-bounds write (CVE-ID: CVE-2026-59184)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in OpenEXRUtil TypedFlatImageChannel<T>::row() when processing a crafted EXR file with a non-zero dataWindow.min. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
User interaction is required to open the crafted EXR file, and exploitation depends on downstream code writing rows through FlatHalfChannel::row() on a loaded image.
12) Integer overflow (CVE-ID: CVE-2026-59183)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in unpack_sample_table() in src/lib/OpenEXRCore/decoding.c when parsing a crafted deep tiled EXR file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
User interaction is required to open a crafted file. Exploitation requires processing deep tiled EXR content through the OpenEXRCore decoding path.
13) Integer overflow (CVE-ID: CVE-2026-55373)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow or wraparound in roundListSizeUp() in OpenEXRUtil SampleCountChannel when processing a sample count of UINT_MAX. A remote attacker can supply a UINT_MAX sample count through the public API to cause a denial of service.
The issue results in an infinite CPU loop in both the endEdit() path and the direct set(x, y, UINT_MAX) path.
14) Integer overflow (CVE-ID: CVE-2026-27622)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to integer overflow in CompositeDeepScanLine::readPixels when parsing a crafted multipart deep EXR file. A remote attacker can supply a specially crafted file to execute arbitrary code.
User interaction is required to open or process the crafted file through multipart deep read flows using MultiPartInputFile, DeepScanLineInputPart, and CompositeDeepScanLine.
15) Integer overflow (CVE-ID: CVE-2026-54920)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in OpenEXRUtil Image::resize() and Image::clearLevels() when processing crafted Imath::Box2i data window coordinates through the public API. A remote attacker can supply crafted coordinate values that trigger exception cleanup and invalid deletion of uninitialized ImageLevel pointers to cause a denial of service.
The issue is confirmed to crash the process through an invalid delete of uninitialized pointer entries during exception cleanup, while remote code execution was not confirmed.
16) Integer overflow (CVE-ID: CVE-2026-42217)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.
The vulnerability exists due to integer overflow or wraparound in readVariableLengthInteger() in ImfIDManifest.cpp when parsing a crafted EXR file containing an idmanifest attribute. A remote attacker can supply a specially crafted EXR file to cause a denial of service and disclose sensitive information.
The corrupted return value is used as a string-list length in readStringList(), which can lead to reads beyond the end of the supplied buffer. User interaction is required to open or process the crafted EXR file.
17) Out-of-bounds read (CVE-ID: CVE-2026-42216)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.
The vulnerability exists due to out-of-bounds read in IDManifest::init() in src/lib/OpenEXR/ImfIDManifest.cpp when parsing a prefix-compressed IDManifest string list from a crafted .exr file. A remote attacker can supply a specially crafted file to disclose sensitive information or cause a denial of service.
Exploitation requires the previous string to be longer than 255 bytes so that the 2-byte prefix-length path is used, and the next string to be empty.
18) Integer overflow (CVE-ID: CVE-2026-41142)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to integer overflow in ImageChannel::resize in OpenEXRUtil when parsing a crafted EXR image or using the public API with a crafted dataWindow. A remote attacker can supply crafted image dimensions that cause an undersized heap allocation and subsequent out-of-bounds write to execute arbitrary code.
User interaction is required to open or process a crafted EXR image.
19) Integer overflow (CVE-ID: CVE-2026-40250)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt the heap.
The vulnerability exists due to integer overflow or wraparound in DwaCompressor_uncompress() in internal_dwa_compressor.h when parsing a crafted DWAA/DWAB EXR file. A remote attacker can trick the victim into opening a crafted file to corrupt the heap.
User interaction is required to open a crafted file.
20) Integer overflow (CVE-ID: CVE-2026-40244)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt heap memory.
The vulnerability exists due to integer overflow in DWA setupChannelData planarUncRle pointer arithmetic when parsing a crafted EXR file. A remote attacker can supply a crafted DWAA/DWAB EXR file with large dimensions to corrupt heap memory.
User interaction is required to open the crafted file, and the issue is triggered on non-DCT channels, including UINT or single-channel layouts.
21) Integer overflow (CVE-ID: CVE-2026-34589)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.
The vulnerability exists due to integer overflow leading to an out-of-bounds write in the DWA lossy decoder when parsing a crafted scanline DWAA file. A remote attacker can supply a specially crafted file to execute arbitrary code or cause a denial of service.
User interaction is required to open or process the crafted file.
22) Integer overflow (CVE-ID: CVE-2026-34588)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read and write out-of-bounds memory.
The vulnerability exists due to integer overflow in internal_exr_undo_piz() in the PIZ decoder when parsing a crafted EXR file. A remote attacker can supply a specially crafted EXR file to read and write out-of-bounds memory.
The issue occurs during PIZ decompression because signed 32-bit arithmetic can wrap while advancing the working wavelet pointer, causing the next channel to decode from an incorrect address.
23) Out-of-bounds write (CVE-ID: CVE-2026-34544)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and corrupt memory.
The vulnerability exists due to out-of-bounds write in uncompress_b44_impl() in internal_b44.c when decoding a crafted B44 or B44A EXR file via exr_decoding_run(). A remote attacker can supply a specially crafted EXR file to cause a denial of service and corrupt memory.
User interaction is required to open or decode the crafted file.
24) Use of uninitialized resource (CVE-ID: CVE-2026-34543)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of uninitialized resource in undo_pxr24_impl and exr_uncompress_buffer when parsing a crafted PXR24 EXR file with a truncated zlib stream. A remote attacker can supply a specially crafted EXR file to disclose sensitive information.
The issue is triggered during decoding under default settings.
25) Integer overflow (CVE-ID: CVE-2026-34380)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and modify memory.
The vulnerability exists due to integer overflow or wraparound in undo_pxr24_impl() in src/lib/OpenEXRCore/internal_pxr24.c when parsing a crafted PXR24-compressed EXR file. A remote attacker can supply a specially crafted EXR file to cause a denial of service and modify memory.
User interaction is required to open or process the crafted file, and exploitation requires a FLOAT channel using PXR24 compression.
26) Type conversion (CVE-ID: CVE-2026-34379)
CWE-ID: CWE-704 - Type conversion
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to incorrect type conversion or cast in LossyDctDecoder_execute() when decoding a DWA- or DWAB-compressed EXR file containing a FLOAT-type channel. A remote attacker can supply a specially crafted EXR file to cause a denial of service.
User interaction is required to open or process the crafted file.
Remediation
Install update from vendor's website.