RHSA-2026:98471: Important: openexr security update

Q: What systems are exposed to these issues?

Systems with the listed Red Hat OpenEXR packages installed are relevant, particularly where OpenEXR binaries or libraries process EXR image files. The affected package set includes the main package, libraries, development files, debug packages, and source-debug packages.

Q: What does an attacker need to exploit these vulnerabilities?

An attacker needs a crafted EXR image file to be processed by OpenEXR or an affected OpenEXR utility. The reported impacts include memory corruption, out-of-bounds reads and writes, denial of service, and information disclosure.

Q: Which issue specifically involves the exrmultiview utility?

CVE-2026-68515 is described as a heap out-of-bounds write in exrmultiview triggered through crafted EXR files.

Published Nov 11, 2026

Updated

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.Security Fix(es): OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189) OpenEXR: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982) OpenEXR: OpenEXR: Heap out-of-bounds write in exrmultiview via crafted EXR files (CVE-2026-68515) OpenEXR: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

24 affected componentsFixes available

redhat/openexr<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-debuginfo<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-debuginfo<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-debugsource<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-debugsource<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-libs<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-libs<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-libs-debuginfo<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-libs-debuginfo<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-debuginfo<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-debugsource<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-libs<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-libs-debuginfo<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr<3.1.1-6.el9_9.2.aa

3.1.1-6.el9_9.2.aa

redhat/openexr-debuginfo<3.1.1-6.el9_9.2.aa

3.1.1-6.el9_9.2.aa

redhat/openexr-debugsource<3.1.1-6.el9_9.2.aa

3.1.1-6.el9_9.2.aa

redhat/openexr-libs<3.1.1-6.el9_9.2.aa

3.1.1-6.el9_9.2.aa

redhat/openexr-libs-debuginfo<3.1.1-6.el9_9.2.aa

3.1.1-6.el9_9.2.aa

redhat/openexr-devel<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-devel<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-devel<3.1.1-6.el9_9.2

3.1.1-6.el9_9.2

redhat/openexr-devel<3.1.1-6.el9_9.2.aa

3.1.1-6.el9_9.2.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/openexr to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2
Upgrade
Upgrade redhat/openexr-debuginfo to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2
Upgrade
Upgrade redhat/openexr-debugsource to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2
Upgrade
Upgrade redhat/openexr-libs to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2
Upgrade
Upgrade redhat/openexr-libs-debuginfo to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2
Upgrade
Upgrade redhat/openexr to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2.aa
Upgrade
Upgrade redhat/openexr-debuginfo to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2.aa
Upgrade
Upgrade redhat/openexr-debugsource to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2.aa
Upgrade
Upgrade redhat/openexr-libs to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2.aa
Upgrade
Upgrade redhat/openexr-libs-debuginfo to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2.aa
Upgrade
Upgrade redhat/openexr-devel to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2
Upgrade
Upgrade redhat/openexr-devel to a version that resolves this vulnerability.
Fixed in 3.1.1-6.el9_9.2.aa

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

What systems are exposed to these issues?

Systems with the listed Red Hat OpenEXR packages installed are relevant, particularly where OpenEXR binaries or libraries process EXR image files. The affected package set includes the main package, libraries, development files, debug packages, and source-debug packages.

What does an attacker need to exploit these vulnerabilities?

An attacker needs a crafted EXR image file to be processed by OpenEXR or an affected OpenEXR utility. The reported impacts include memory corruption, out-of-bounds reads and writes, denial of service, and information disclosure.

Which issue specifically involves the exrmultiview utility?

CVE-2026-68515 is described as a heap out-of-bounds write in exrmultiview triggered through crafted EXR files.

RHSA-2026:98471: Important: openexr security update

Affected Software

Remediation

Event History

Frequently Asked Questions

What systems are exposed to these issues?

What does an attacker need to exploit these vulnerabilities?

Which issue specifically involves the exrmultiview utility?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to these issues?

What does an attacker need to exploit these vulnerabilities?

Which issue specifically involves the exrmultiview utility?