ALSA-2026:86983: Important: openexr security update

Q: Which systems should be prioritized for triage?

The advisory identifies the almalinux/openexr-devel package. Prioritize systems that process EXR image files, especially where EXR files can originate from untrusted sources.

Q: What must an attacker provide to trigger the reported issues?

The reported vulnerabilities are triggered through processing crafted EXR image files. The advisory does not state that network access, authentication, or any particular application configuration is required.

Q: What are the potential consequences of successful exploitation?

The listed issues can lead to memory corruption, out-of-bounds reads or writes, denial of service, and information disclosure. The advisory does not provide further exploitability details or CVSS scores.

Published Oct 21, 2026

Updated

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.

Security Fix(es):

openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) openexr: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982) openexr: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) openexr: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189) openexr: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

almalinux/openexr-devel<3.1.1-3.el9_8.5

3.1.1-3.el9_8.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/openexr-devel to a version that resolves this vulnerability.
Fixed in 3.1.1-3.el9_8.5

Event History

Oct 21, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems should be prioritized for triage?

The advisory identifies the almalinux/openexr-devel package. Prioritize systems that process EXR image files, especially where EXR files can originate from untrusted sources.

What must an attacker provide to trigger the reported issues?

The reported vulnerabilities are triggered through processing crafted EXR image files. The advisory does not state that network access, authentication, or any particular application configuration is required.

What are the potential consequences of successful exploitation?

The listed issues can lead to memory corruption, out-of-bounds reads or writes, denial of service, and information disclosure. The advisory does not provide further exploitability details or CVSS scores.

ALSA-2026:86983: Important: openexr security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems should be prioritized for triage?

What must an attacker provide to trigger the reported issues?

What are the potential consequences of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems should be prioritized for triage?

What must an attacker provide to trigger the reported issues?

What are the potential consequences of successful exploitation?