Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

OpenEXR packages may let attackers run code

published 3 months ago

Summary

The OpenEXR libraries and related debug packages on Red Hat systems contain a flaw that could let a malicious user execute code on the server. This could affect any programs that use these libraries. Install the latest Red Hat OpenEXR updates as soon as possible to protect your system.

What to do

Update redhat openexr to version 0:3.1.10-8.el10_0.3.
Update redhat openexr-debuginfo to version 0:3.1.10-8.el10_0.3.
Update redhat openexr-debugsource to version 0:3.1.10-8.el10_0.3.
Update redhat openexr-libs to version 0:3.1.10-8.el10_0.3.
Update redhat openexr-libs-debuginfo to version 0:3.1.10-8.el10_0.3.
Update redhat openexr-devel to version 0:3.1.10-8.el10_0.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux_eus:10.0	redhat	openexr	< 0:3.1.10-8.el10_0.3 Fix: upgrade to 0:3.1.10-8.el10_0.3
Red Hat:enterprise_linux_eus:10.0	redhat	openexr-debuginfo	< 0:3.1.10-8.el10_0.3 Fix: upgrade to 0:3.1.10-8.el10_0.3
Red Hat:enterprise_linux_eus:10.0	redhat	openexr-debugsource	< 0:3.1.10-8.el10_0.3 Fix: upgrade to 0:3.1.10-8.el10_0.3
Red Hat:enterprise_linux_eus:10.0	redhat	openexr-libs	< 0:3.1.10-8.el10_0.3 Fix: upgrade to 0:3.1.10-8.el10_0.3
Red Hat:enterprise_linux_eus:10.0	redhat	openexr-libs-debuginfo	< 0:3.1.10-8.el10_0.3 Fix: upgrade to 0:3.1.10-8.el10_0.3
Red Hat:enterprise_linux_eus:10.0	redhat	openexr-devel	< 0:3.1.10-8.el10_0.3 Fix: upgrade to 0:3.1.10-8.el10_0.3

Original advisory text

Red Hat Security Advisory: openexr security update

References

https://access.redhat.com/errata/RHSA-2026:39024 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467623 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467633 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39024.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-41142 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-41142 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41142 Vendor Advisory
https://github.com/AcademySoftwareFoundation/openexr/commit/0592ee539f33c122c90f... Third Party Advisory
https://github.com/AcademySoftwareFoundation/openexr/pull/2367 Third Party Advisory
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m2... Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-42216 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-42216 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42216 Vendor Advisory
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-65... Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Timeline

Published14 Jul 2026

Updated2 Oct 2026

First seen2 Oct 2026

Sources

RHSA-2026:39024 · OSV

Track software like this

Free during beta