Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: openexr fixed in 3.4.2-r0
AnalysisAI
OpenEXR, the high dynamic range image format library, has been patched in Alpine Linux at package version 3.4.2-r0. The underlying vulnerability details are not publicly disclosed at the time of analysis - no CVE description, CVSS vector, or CWE classification have been published. Alpine Linux's vendor advisory is the sole confirmed intelligence source, indicating this was identified and remediated at the distribution packaging level. With an EPSS score of 0.11% (29th percentile), exploitation probability is low, and no active exploitation has been reported.
Technical ContextAI
OpenEXR is an open-source high dynamic range (HDR) image file format and library originally developed by Industrial Light & Magic, widely used in visual effects, rendering pipelines, and scientific imaging. It is incorporated as a dependency in many Linux distributions including Alpine Linux. Alpine Linux packages openexr separately, and the fix is contained in the Alpine package version 3.4.2-r0, which corresponds to upstream openexr release 3.4.2. Without a CWE classification or CVSS vector in the available data, the root cause class - whether memory corruption, parsing error, integer overflow, or other - cannot be confirmed. The library's attack surface typically involves parsing crafted EXR image files, which historically has been associated with memory safety issues in image-processing libraries.
Affected ProductsAI
OpenEXR as packaged in Alpine Linux is confirmed affected, with the fix delivered in Alpine package version openexr-3.4.2-r0. The specific Alpine Linux release branches receiving this fix are not enumerated in the available data. The upstream openexr project version boundary (i.e., which upstream versions prior to 3.4.2 are vulnerable) is not confirmed from the available intelligence. No CPE strings were provided. Users of OpenEXR on other Linux distributions (Debian, Ubuntu, Fedora, RHEL) or via direct upstream builds should consult their respective vendor advisories, as Alpine's packaging fix does not confirm the scope of impact on other distributions.
RemediationAI
Alpine Linux users should upgrade the openexr package to version 3.4.2-r0 or later using the standard apk package manager: 'apk upgrade openexr'. This is the vendor-confirmed fix per Alpine Linux's security advisory. Users on other distributions should monitor upstream OpenEXR release notes for version 3.4.2 and apply distribution-specific package updates as they become available. No workarounds or compensating controls are identified from the available data. If OpenEXR is used as a dependency in containerized environments based on Alpine Linux, rebuilding container images against the updated Alpine package repositories will apply the fix. No advisory URL beyond the Alpine vendor report is available in the current intelligence set.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today