Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: openexr fixed in 3.4.2-r0
AnalysisAI
OpenEXR, the high-dynamic-range image format library widely used in professional visual effects and imaging pipelines, has received a security fix in Alpine Linux package version 3.4.2-r0. The nature of the underlying vulnerability is not disclosed in available intelligence - no CVE description, CVSS vector, CWE classification, or vendor advisory detail accompanies this entry. The fix was reported solely by the Alpine Linux vendor channel. No public exploit code has been identified at time of analysis, and CISA KEV confirmation of active exploitation is absent.
Technical ContextAI
OpenEXR is an open-source, high-dynamic-range image file format library originally developed by Industrial Light & Magic and now maintained under the Academy Software Foundation. It is used extensively in film production, VFX toolchains, and imaging software. Common vulnerability classes in image parsing libraries include heap buffer overflows, out-of-bounds reads, integer overflows during dimension or tile calculations, and use-after-free conditions triggered by malformed image files. The exact root cause class (CWE) for this CVE is not available in the provided intelligence. The affected package is identified in the Alpine Linux ecosystem as 'openexr', fixed at Alpine package version 3.4.2-r0, which corresponds to the upstream OpenEXR 3.4.2 release. No CPE strings were provided.
Affected ProductsAI
The affected product is the OpenEXR library as packaged in Alpine Linux, fixed in Alpine package version openexr 3.4.2-r0. The specific upstream OpenEXR versions prior to 3.4.2 that are vulnerable are not enumerated in the available intelligence. No CPE strings were provided. The fix was reported exclusively through the Alpine Linux vendor channel; no corresponding upstream OpenEXR security advisory or Academy Software Foundation bulletin was referenced in the provided data.
RemediationAI
Alpine Linux users should upgrade the openexr package to version 3.4.2-r0 or later using the standard Alpine package manager: 'apk upgrade openexr'. This is the only confirmed fix identified in the available intelligence. No upstream vendor advisory URL was provided, so administrators should consult the Alpine Linux security tracker and the OpenEXR GitHub repository for additional context. In the absence of patch deployment, compensating controls should include restricting the processing of untrusted or externally sourced EXR image files, sandboxing image-parsing processes using seccomp or containers to limit blast radius, and monitoring for unexpected process crashes or memory anomalies in services that consume EXR content. No exact upstream fix version beyond the Alpine packaging reference (3.4.2-r0) was independently confirmed from the provided data.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today