OP
Product
Openexr
78
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 25Medium 45Low 1
Watch
Add Openexr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45696 | 6.5 | Jun 18 | OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS) Affected: 3.4.0 before 3.4.12 |
| CVE-2026-34378 | 6.5 | Apr 6 | OpenEXR has a signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x Affected: 3.4.0 before 3.4.9 |
| CVE-2026-26981 | 6.5 | Feb 24 | OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp Affected: 3.3.0 before 3.3.7; 3.4.0 before 3.4.5 |
| CVE-2021-3941 | 6.5 | Mar 25 | In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y… Affected: 3.1.2 |
| CVE-2017-9116 | 6.5 | May 21 | In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash Affected: 2.2.0 |
| CVE-2017-9114 | 6.5 | May 21 | In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash Affected: 2.2.0 |
| CVE-2017-9112 | 6.5 | May 21 | In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash Affected: 2.2.0 |
| CVE-2017-9110 | 6.5 | May 21 | In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash Affected: 2.2.0 |
| CVE-2025-48073 | 6.2 | Jul 31 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry Affected: 3.3.2 |
| CVE-2021-20303 | 6.1 | Mar 4 | A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp Affected: before 2.5.4 |
| CVE-2026-34380 | 5.9 | Apr 6 | OpenEXR has a signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression Affected: 3.2.0 before 3.2.7; 3.3.0 before 3.3.9; 3.4.0 before 3.4.9 |
| CVE-2025-48074 | 5.5 | Aug 1 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry Affected: 3.3.2 |
| CVE-2021-3933 | 5.5 | Mar 25 | An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits Affected: before 3.1.2 |
| CVE-2021-20302 | 5.5 | Mar 4 | A flaw was found in OpenEXR's TiledInputFile functionality Affected: before 2.5.4 |
| CVE-2021-20300 | 5.5 | Mar 4 | A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp Affected: before 2.5.4 |
| CVE-2021-45942 | 5.5 | Jan 1 | OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and… Affected: 3.1.0 before 3.1.4 |
| CVE-2021-3605 | 5.5 | Aug 25 | There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5 Affected: before 3.0.5 |
| CVE-2021-3598 | 5.5 | Jul 6 | There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5 Affected: before 3.0.5 |
| CVE-2021-26945 | 5.5 | Jun 8 | An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1 Affected: before 3.0.1 |
| CVE-2021-26260 | 5.5 | Jun 8 | An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1 Affected: before 3.0.1 |
| CVE-2021-23215 | 5.5 | Jun 8 | An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1 Affected: before 3.0.1 |
| CVE-2021-3479 | 5.5 | Mar 31 | There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta Affected: before 2.4.3; 2.5.0 before 2.5.4 |
| CVE-2021-3478 | 5.5 | Mar 31 | There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta Affected: before 2.4.3; 2.5.0 before 2.5.4 |
| CVE-2021-3477 | 5.5 | Mar 31 | There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta Affected: before 2.4.3; 2.5.0 before 2.5.4 |
| CVE-2020-16589 | 5.5 | Dec 9 | A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR… Affected: 2.3.0 |
| CVE-2020-16588 | 5.5 | Dec 9 | A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file Affected: 2.3.0 |
| CVE-2020-16587 | 5.5 | Dec 9 | A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of… Affected: 2.3.0 |
| CVE-2020-15306 | 5.5 | Jun 26 | An issue was discovered in OpenEXR before v2.5.2 Affected: before 2.5.2 |
| CVE-2020-15305 | 5.5 | Jun 26 | An issue was discovered in OpenEXR before 2.5.2 Affected: before 2.5.2 |
| CVE-2020-15304 | 5.5 | Jun 26 | An issue was discovered in OpenEXR before 2.5.2 Affected: before 2.5.2 |
| CVE-2020-11765 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 2.4.1 |
| CVE-2020-11764 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 2.4.1 |
| CVE-2020-11763 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 2.4.1 |
| CVE-2020-11762 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 2.4.1 |
| CVE-2020-11761 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 2.4.1 |
| CVE-2020-11760 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 2.4.1 |
| CVE-2020-11759 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 2.4.1 |
| CVE-2020-11758 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 2.4.1 |
| CVE-2017-14988 | 5.5 | Oct 3 | Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file that is accessed… Affected: 2.2.0 |
| CVE-2026-39886 | 5.3 | Apr 21 | OpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl() Affected: 3.4.0 before 3.4.10 |
| CVE-2021-20296 | 5.3 | Apr 1 | A flaw was found in OpenEXR in versions before 3.0.0-beta Affected: before 2.4.3; 2.5.0 before 2.5.4 |
| CVE-2021-3476 | 5.3 | Mar 30 | A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta Affected: before 2.4.3; 2.5.0 before 2.5.4 |
| CVE-2021-3475 | 5.3 | Mar 30 | There is a flaw in OpenEXR in versions before 3.0.0-beta Affected: before 2.4.3; 2.5.0 before 2.5.4 |
| CVE-2021-3474 | 5.3 | Mar 30 | There's a flaw in OpenEXR in versions before 3.0.0-beta Affected: before 2.4.3; 2.5.0 before 2.5.4 |
| CVE-2026-34589 | 5.0 | Apr 6 | OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write Affected: 3.2.0 before 3.2.7; 3.3.0 before 3.3.9; 3.4.0 before 3.4.9 |
Showing 45
