Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
OpenEXR versions before 3 may cause memory corruption
published 4 days ago
Summary
The OpenEXR library (cleanstart/openexr) versions older than 3 contain a coding mistake that can let specially crafted data overwrite memory. This could cause a program that uses the library to crash or behave unexpectedly. Upgrade to version 3 or later, or apply the vendor's patch, to eliminate the risk.
What to do
- Update cleanstart openexr to version 3.1.1-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | openexr |
< 3.1.1-r0 Fix: upgrade to 3.1.1-r0
|
Original advisory text
integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3
Security vulnerability affects the openexr package. An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2025-VC37766 · OSV
Track software like this
Free during beta