Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenEXR: Potential Data Corruption and Crashes
published 3 months ago
Summary
This security update fixes three issues in OpenEXR that could cause data corruption, crashes, or unexpected behavior. Affected users should update to the latest version to prevent potential problems. If you're using OpenEXR, it's recommended to apply this update as soon as possible.
What to do
- Update opensuse openexr to version 3.2.2-160000.9.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensuse | openexr |
< 3.2.2-160000.9.1 Fix: upgrade to 3.2.2-160000.9.1
|
Original advisory text
Security update for openexr
This update for openexr fixes the following issues
- CVE-2026-54920: unchecked integer overflows in Image::resize() followed by an exception can lead to an invalid delete
via uninitialized pointers (bsc#1269703).
- CVE-2026-55059: row setter utilizing dataWindow.min.x instead of min.y can lead to a heap out-of-bounds write
(bsc#1269702).
- CVE-2026-55373: integer overflow in roundListSizeUp() wrapping a 32-bit unsigned value to zero can lead to an infinite
loop (bsc#1269701).
- CVE-2026-54920: unchecked integer overflows in Image::resize() followed by an exception can lead to an invalid delete
via uninitialized pointers (bsc#1269703).
- CVE-2026-55059: row setter utilizing dataWindow.min.x instead of min.y can lead to a heap out-of-bounds write
(bsc#1269702).
- CVE-2026-55373: integer overflow in roundListSizeUp() wrapping a 32-bit unsigned value to zero can lead to an infinite
loop (bsc#1269701).
References
- https://bugzilla.suse.com/1269701 Third Party Advisory
- https://bugzilla.suse.com/1269702 Third Party Advisory
- https://bugzilla.suse.com/1269703 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-54920 URL
- https://www.suse.com/security/cve/CVE-2026-55059 URL
- https://www.suse.com/security/cve/CVE-2026-55373 URL
Timeline
Published14 Jul 2026
Updated15 Jul 2026
First seen15 Jul 2026
Sources
openSUSE-SU-2026:21336-1 · OSV
Track software like this
Free during beta