Read the docs
TI-2026-22004 Aliases CVE-2026-27622GHSA-cr4v-6jm6-4963

OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

Priority LOW 38CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 22 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00241 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial openexr (AcademySoftwareFoundation): 3.2.6, 3.3.8, 3.4.6OpenEXR (PyPI): 3.2.6, 3.3.8, 3.4.6Red Hat: 16 advisoriesRed Hat: 22 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AcademySoftwareFoundationopenexr2.3.0 to before 3.2.6; 3.3.0 to before 3.3.8; 3.4.0 to before 3.4.63.2.6, 3.3.8, 3.4.6Patch availableCNA
—OpenEXR (PyPI)2.3.0 to before 3.2.63.2.6Patch availableGHSA-cr4v-6jm6-4963
—OpenEXR (PyPI)3.3.0 to before 3.3.83.3.8Patch availableGHSA-cr4v-6jm6-4963
—OpenEXR (PyPI)3.4.0 to before 3.4.63.4.6Patch availableGHSA-cr4v-6jm6-4963
  • openexr VendorAcademySoftwareFoundation Affected 2.3.0 to before 3.2.6; 3.3.0 to before 3.3.8; 3.4.0 to before 3.4.6 Fixed in 3.2.6, 3.3.8, 3.4.6 Patch available CNA
  • OpenEXR (PyPI) Vendor— Affected 2.3.0 to before 3.2.6 Fixed in 3.2.6 Patch available GHSA-cr4v-6jm6-4963
  • OpenEXR (PyPI) Vendor— Affected 3.3.0 to before 3.3.8 Fixed in 3.3.8 Patch available GHSA-cr4v-6jm6-4963
  • OpenEXR (PyPI) Vendor— Affected 3.4.0 to before 3.4.6 Fixed in 3.4.6 Patch available GHSA-cr4v-6jm6-4963

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*before 3.2.6; 3.3.0 to before 3.3.8; 3.4.0 to before 3.4.6VulnerableAcademy Software Foundation
  • cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:* Versions before 3.2.6; 3.3.0 to before 3.3.8; 3.4.0 to before 3.4.6 Vulnerable ·Academy Software Foundation

Remediation

  • Fix · CNA openexr (AcademySoftwareFoundation) Fixed in 3.2.6, 3.3.8, 3.4.6
  • Fix · GHSA-cr4v-6jm6-4963 OpenEXR (PyPI) Fixed in 3.2.6 Advisory →
  • Fix · GHSA-cr4v-6jm6-4963 OpenEXR (PyPI) Fixed in 3.3.8 Advisory →
  • Fix · GHSA-cr4v-6jm6-4963 OpenEXR (PyPI) Fixed in 3.4.6 Advisory →

Red Hat 16 advisories

  • RHSA-2026:16174 Released 2026-05-12 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.3 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:16030 Released 2026-05-11 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.3 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:16009 Released 2026-05-11 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.3 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
Show 13 more Red Hat advisories
  • RHSA-2026:16008 Released 2026-05-11 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.3 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:12338 Released 2026-04-30 · Red Hat rating Important
    OpenEXR security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) OpenEXR-2.2.0-12.el8_8.1, OpenEXR-libs-2.2.0-12.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) OpenEXR-2.2.0-12.el8_8.1, OpenEXR-libs-2.2.0-12.el8_8.1
  • RHSA-2026:12339 Released 2026-04-30 · Red Hat rating Important
    OpenEXR security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) OpenEXR-2.2.0-12.el8_6.1, OpenEXR-libs-2.2.0-12.el8_6.1
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) OpenEXR-2.2.0-12.el8_6.1, OpenEXR-libs-2.2.0-12.el8_6.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) OpenEXR-2.2.0-12.el8_6.1, OpenEXR-libs-2.2.0-12.el8_6.1
  • RHSA-2026:12341 Released 2026-04-30 · Red Hat rating Important
    OpenEXR security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) OpenEXR-2.2.0-12.el8_4.1, OpenEXR-libs-2.2.0-12.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) OpenEXR-2.2.0-12.el8_4.1, OpenEXR-libs-2.2.0-12.el8_4.1
  • RHSA-2026:12340 Released 2026-04-30 · Red Hat rating Important
    OpenEXR security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) OpenEXR-2.2.0-11.el8_2.1, OpenEXR-libs-2.2.0-11.el8_2.1
  • RHSA-2026:8872 Released 2026-04-20 · Red Hat rating Important
    openexr security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) openexr-devel-3.1.1-3.el9_6.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) openexr-3.1.1-3.el9_6.1, openexr-libs-3.1.1-3.el9_6.1
  • RHSA-2026:8888 Released 2026-04-20 · Red Hat rating Important
    openexr security update
    • Red Hat Enterprise Linux AppStream (v. 9) openexr-3.1.1-3.el9_7.1, openexr-libs-3.1.1-3.el9_7.1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) openexr-devel-3.1.1-3.el9_7.1
  • RHSA-2026:8870 Released 2026-04-20 · Red Hat rating Important
    openexr security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) openexr-3.1.1-2.el9_0.2, openexr-libs-3.1.1-2.el9_0.2
  • RHSA-2026:8871 Released 2026-04-20 · Red Hat rating Important
    openexr security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) openexr-devel-3.1.1-2.el9_4.2
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) openexr-3.1.1-2.el9_4.2, openexr-libs-3.1.1-2.el9_4.2
  • RHSA-2026:8863 Released 2026-04-20 · Red Hat rating Important
    OpenEXR security update
    • Red Hat Enterprise Linux AppStream (v. 8) OpenEXR-2.2.0-12.el8_10.1, OpenEXR-libs-2.2.0-12.el8_10.1
    • Red Hat Enterprise Linux CRB (v. 8) OpenEXR-devel-2.2.0-12.el8_10.1
  • RHSA-2026:8869 Released 2026-04-20 · Red Hat rating Important
    openexr security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) openexr-3.1.1-2.el9_2.2, openexr-libs-3.1.1-2.el9_2.2
  • RHSA-2026:7682 Released 2026-04-13 · Red Hat rating Important
    openexr security update
    • Red Hat Enterprise Linux AppStream (v. 10) openexr-3.1.10-8.el10_1.1, openexr-libs-3.1.10-8.el10_1.1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) openexr-devel-3.1.10-8.el10_1.1
  • RHSA-2026:7678 Released 2026-04-13 · Red Hat rating Important
    openexr security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) openexr-3.1.10-8.el10_0.1, openexr-libs-3.1.10-8.el10_0.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat AI Inference Server 3.3Fixed RHSA-2026:16008, RHSA-2026:16009, RHSA-2026:16030, RHSA-2026:16174
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:8871
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:8872
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:7682
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:8863
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:8888
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:12340
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:12341
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:12339
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:12339
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:12338
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:8870
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:8869
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:7678
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:8871
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:8872
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:12341
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:12339
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:12338
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:8863
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:7682
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:8888
Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27622
  2. 2026-10-03 Alias added: GHSA-cr4v-6jm6-4963

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-30739 OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser CVSS 4.0HIGH 8.4
  • TI-2026-38605 OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) CVSS 4.0HIGH 7.1
  • TI-2026-48281 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union CVSS 3.1HIGH 7.1
  • TI-2026-48279 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision CVSS 3.1HIGH 7.1
  • TI-2026-42768 OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow CVSS 3.1HIGH 7.1
  • TI-2026-42338 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin CVSS 3.1HIGH 7.1
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences