Integer overflow in OpenEXR - CVE-2026-27622

Vulnerability identifier: #VU125325

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-27622

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer overflow in CompositeDeepScanLine::readPixels when parsing a crafted multipart deep EXR file. A remote attacker can supply a specially crafted file to execute arbitrary code.

User interaction is required to open or process the crafted file through multipart deep read flows using MultiPartInputFile, DeepScanLineInputPart, and CompositeDeepScanLine.

OpenEXR
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
openEuler
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openexr (Ubuntu package)
OpenEXR (Red Hat package)
OpenEXR-doc
OpenEXR
OpenEXR-devel
OpenEXR-libs
OpenEXR-debuginfo
OpenEXR-debugsource
mingw-openexr

Install security update from vendor's website.

OpenEXR - addressed in versions 3.2.6, 3.3.8, 3.4.6
openexr (Ubuntu package) - addressed in versions 2.2.0-10ubuntu2.6+esm4, 2.2.0-11.1ubuntu1.9+esm1, 2.3.0-6ubuntu0.5+esm2, 2.5.7-1ubuntu0.1~esm2, 3.1.5-5.1ubuntu0.1~esm1, 3.1.13-2ubuntu0.26.04.1~esm1
OpenEXR (Red Hat package) - addressed in versions 2.2.0-11.el8_2.1, 2.2.0-12.el8_4.1, 2.2.0-12.el8_6.1, 2.2.0-12.el8_8.1, 3.1.1-3.el9_7.1, 3.1.10-8.el10_0.1, 3.1.10-8.el10_1.1
OpenEXR-doc - addressed in versions 2.2.0-12.0.1, 3.4.4-2
OpenEXR - addressed in versions 2.2.0-12.0.1, 3.4.4-2
OpenEXR-devel - addressed in versions 2.2.0-12.0.1, 3.4.4-2
OpenEXR-libs - addressed in versions 2.2.0-12.0.1, 3.4.4-2
OpenEXR-debuginfo - addressed in versions 3.1.5-5, 3.1.11-5
OpenEXR-libs - addressed in versions 3.1.5-5, 3.1.11-5
OpenEXR-devel - addressed in versions 3.1.5-5, 3.1.11-5
OpenEXR-debugsource - addressed in versions 3.1.5-5, 3.1.11-5
OpenEXR - addressed in versions 3.1.5-5, 3.1.11-5
mingw-openexr - addressed in versions 3.3.8-1.fc42, 3.3.8-1.fc43, 3.4.6-1.fc44

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963
• https://github.com/advisories/GHSA-cr4v-6jm6-4963

• Integer overflow in OpenEXR
• Fedora 42 update for mingw-openexr
• Fedora 43 update for mingw-openexr
• Fedora 44 update for mingw-openexr
• openEuler 24.03 LTS SP3 update for OpenEXR
• openEuler 24.03 LTS SP2 update for OpenEXR
• openEuler 24.03 LTS SP1 update for OpenEXR
• openEuler 24.03 LTS update for OpenEXR
• openEuler 22.03 LTS SP4 update for OpenEXR
• Anolis OS update for OpenEXR
• Red Hat Enterprise Linux 10 update for openexr
• Red Hat Enterprise Linux 10 update for openexr
• Red Hat Enterprise Linux 9 update for openexr
• Anolis OS update for OpenEXR
• Red Hat Enterprise Linux 8 update for OpenEXR
• Red Hat Enterprise Linux 8 update for OpenEXR
• Red Hat Enterprise Linux 8 update for OpenEXR
• Red Hat Enterprise Linux 8 update for OpenEXR
• Ubuntu update for openexr