21
CVEs
0
Critical
11
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
11
MEDIUM
9
LOW
0
Monthly CVE Trend
Affected Products (4)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-42450 | Stack buffer overflow in OpenColorIO's .spi3d LUT parser allows a crafted color-lookup file to corrupt memory in any application that loads it. The flaw in FileFormatSpi3D.cpp reads attacker-controlled data from a 4096-byte line into 64-byte stack buffers via unbounded sscanf %s, permitting an overflow of roughly 4000 bytes on non-Windows platforms. It affects all OCIO 1.x and 2.x releases prior to 2.5.2 and, while no public exploit has been identified, the same unsafe pattern was found across the .spi3d, .spi1d, .cube, and .lut parsers. | HIGH | 8.4 | 0.1% | 42 |
|
| CVE-2026-45696 | Heap-buffer-overflow READ in OpenEXR 3.4.0 through 3.4.11 occurs in the HTJ2K decoder's ht_undo_impl() function when processing a crafted EXR file with mismatched codestream and channel widths, producing a deterministic crash and potential adjacent-heap memory disclosure. Any application that opens untrusted EXR files - including thumbnailers, asset pipelines, and the exrcheck utility - is reachable via the standard scanline-decode entry point. No public exploit identified at time of analysis, but the upstream fix is shipped in v3.4.12. | HIGH | 8.3 | 0.3% | 42 |
|
| CVE-2026-59982 | Out-of-bounds pointer arithmetic in OpenEXR's TypedDeepImageChannel::row() - and parallel methods in FlatImageChannel and SampleCountChannel - affects all releases before 3.2.11, 3.3.13, and 3.4.14, exposing applications that process deep EXR files with nonzero dataWindow origins to deterministic crash or limited heap memory disclosure. The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R) reflects unauthenticated, low-complexity delivery of a crafted image file requiring only that a user or pipeline opens it, with high availability impact and limited confidentiality exposure. No CISA KEV listing and no public exploit code have been identified at time of analysis; patched releases are available from the Academy Software Foundation. | HIGH | 7.1 | 0.3% | 36 |
|
| CVE-2026-53532 | Process-aborting denial of service in OpenEXR 3.4.0 through 3.4.12 allows an unauthenticated remote attacker to crash any application that calls exr_start_read() on a crafted HTJ2K-compressed EXR file. The crash originates in the vendored OpenJPH library, which invokes abort() unconditionally when a QCD marker's lower five bits are zero - an assertion failure that OpenEXR's partial error handling cannot intercept because codestream read and construction calls are left unprotected. No public exploit has been identified at time of analysis; the vulnerability is patched in version 3.4.13. | HIGH | 7.1 | 0.3% | 36 |
|
| CVE-2026-59189 | Heap out-of-bounds read in OpenEXRUtil's deep and flat image channel row() API allows an attacker supplying a crafted EXR file with a non-zero dataWindow origin to crash any application that processes the file, with conditional heap memory disclosure dependent on attacker-controlled heap layout. Affected are OpenEXRUtil versions 3.3.0-3.3.12 and 3.4.0-3.4.12; the flaw exists across three channel header implementations (ImfDeepImageChannel.h, ImfFlatImageChannel.h, ImfSampleCountChannel.h). No public exploit identified at time of analysis, and patched releases 3.3.13 and 3.4.13 are available. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-59186 | Heap out-of-bounds write in OpenEXR's TiledRgbaInputFile RGBA API affects all three active release lines on 32-bit/ILP32 builds, allowing a remote attacker to deliver a crafted EXR file that crashes or corrupts the heap of any application that opens it. The root cause is a 32-bit integer overflow in the Array2D<Rgba> buffer size calculation when tile dimensions (65537×65537) are encoded in the file header but the actual dataWindow is tiny (40×40), causing the allocator to produce an undersized buffer that tile decode then overflows. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-released patches are available across all three affected release branches. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-59184 | Out-of-bounds and use-after-free memory writes in OpenEXR's FlatImageChannel row() API expose rendering pipelines and image-processing services to denial-of-service and potential memory corruption when handling untrusted EXR files. Affected versions include all releases before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13; the flaw is triggered specifically when an application calls FlatHalfChannel::row() on an EXR image with a nonzero dataWindow.min value. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-59187 | Heap out-of-bounds write in OpenEXR 3.3.0-3.3.12 and 3.4.0-3.4.13 allows an attacker who can supply a crafted deep scanline EXR file to crash the exrmetrics utility or potentially execute arbitrary code when pixel conversion options are active. The flaw arises from a HALF/FLOAT element-size mismatch: sample buffers are allocated for 2-byte HALF input while DeepSlice writes 4-byte FLOAT output, overrunning the heap. No public exploit or active exploitation has been identified at time of analysis; fixed releases 3.3.13 and 3.4.14 are available. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-68513 | Heap buffer overflow in PyOpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 allows an attacker to corrupt process memory by supplying a crafted EXR image file containing conflicting literal and prefixed RGB channel names. When the Python wrapper decodes such a file under the default separate_channels=False mode, a channel-name key collision causes the coalescing logic to reuse an undersized NumPy array and write pixel data out of bounds on the heap, producing high integrity and availability impact with no confidentiality exposure. No public exploit code has been identified and no active exploitation is confirmed; patched releases 3.3.13 and 3.4.14 are available from the Academy Software Foundation. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-44663 | Heap out-of-bounds write in OpenEXR 3.4.0 through 3.4.11 lets an attacker who supplies a crafted HTJ2K-compressed EXR file trigger memory corruption during decoding, via an integer overflow in the HTJ2K decoder ht_undo_impl(). Any application that decodes untrusted EXR images using the affected OpenEXRCore library is at risk, with potential for memory corruption and possible code execution. No public exploit has been identified at time of analysis; EPSS risk is low (0.17%, 7th percentile) and CISA SSVC rates exploitation as none. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-68515 | Heap out-of-bounds write in OpenEXR's exrmultiview utility allows an attacker who can supply crafted EXR files to corrupt heap memory when the tool combines two individually valid scanline EXR files whose union dataWindow is misaligned to one view's channel subsampling. Affected are OpenEXR versions across three maintained branches (pre-3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13), all fixed in their respective patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, though the attack is achievable via normal command-line invocation with attacker-supplied files in VFX pipeline contexts. | HIGH | 7.1 | 0.1% | 36 |
|
| CVE-2026-55371 | NULL pointer dereference in OpenEXR 3.4.0-3.4.12 causes a deterministic crash in the OpenEXRCore C API function `exr_attr_set_bytes()` when a caller passes a positive `hint_length` alongside a NULL `type_hint` pointer, enabling reliable denial of service against any application that processes EXR content via this API. The flaw is confined to availability impact with no confidentiality or integrity exposure, and the CVSS 4.0 local attack vector limits remote exploitation to indirect paths such as network-facing EXR parsing pipelines. No public exploit code or active exploitation has been identified; a vendor-released patch is available in version 3.4.13. | MEDIUM | 6.9 | 0.1% | 35 |
|
| CVE-2026-55373 | Infinite-loop denial of service in OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 allows an attacker to permanently hang any process that parses a crafted EXR image by triggering an integer overflow in the sample-count helper roundListSizeUp(). When UINT_MAX is passed as a sample-count value, 32-bit unsigned left-shift arithmetic wraps the accumulator to zero, producing a loop condition that never terminates. The vulnerability is reachable through public OpenEXRUtil APIs, making it exploitable wherever applications accept externally-supplied EXR files. No public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 6.2 | 0.1% | 31 |
|
| CVE-2026-55059 | Heap out-of-bounds write in OpenEXR's DeepImage API affects all versions prior to 3.2.10, 3.3.12, and 3.4.13, exploitable by processing a crafted deep image EXR file. A coordinate axis confusion bug in `Imf_4_0::SampleCountChannel::set()` uses `dataWindow.min.x` instead of `dataWindow.min.y` when computing a target Y coordinate, causing memory writes before the allocated `_numSamples` heap buffer when `min.x ≠ min.y`. No public exploit identified at time of analysis; SUSE Linux Enterprise distributions have received vendor-released patches confirming active remediation. | MEDIUM | 6.1 | 0.1% | 31 |
|
| CVE-2026-68514 | Heap buffer overflow in PyOpenEXR Python bindings versions 3.3.0-3.3.12 and 3.4.0-3.4.13 causes memory corruption and process crash when opening a crafted deep scanline EXR file. A specific channel naming collision - a literal channel 'left' coexisting with layer-prefixed 'left.R', 'left.G', 'left.B' - causes the wrapper to allocate scalar-shaped deep sample storage and then write into it at RGB stride (three lanes), overflowing the heap allocation. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 3.3.13 and 3.4.14. | MEDIUM | 5.5 | 0.2% | 28 |
|