Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

openexr

15 known vulnerabilities (6 high, 6 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
3.5.3 (Oct 31, 2026): no advisory affects it
Newest unaffected release
3.5.3 (Oct 31, 2026), the latest release
Advisories
15 · 6 high, 6 medium, 1 low
Weekly downloads
212.8K
Dependents
64
Releases
58 since 1.0.2 (Jul 13, 2009)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-34589
    Affects 3.2.3 to 3.2.6 (3.2.7 is outside it); 3.3.0 to 3.3.8 (3.3.9 is outside it); 3.4.0 to 3.4.8 (3.4.9 is outside it)
  • CVE-2026-34588
    Affects 3.2.3 to 3.2.6 (3.2.7 is outside it); 3.3.0 to 3.3.8 (3.3.9 is outside it); 3.4.0 to 3.4.8 (3.4.9 is outside it)
  • CVE-2026-34543
    Affects 3.2.3 to 3.4.7 (3.4.8 is outside it)
  • CVE-2026-34544
    Affects 3.2.3 to 3.4.7 (3.4.8 is outside it)
  • CVE-2026-27622
    Affects 3.2.3 to 3.2.5 (3.2.6 is outside it); 3.3.0 to 3.3.7 (3.3.8 is outside it); 3.4.0 to 3.4.5 (3.4.6 is outside it)
  • CVE-2026-26981
    Affects 3.3.0 to 3.3.6 (3.3.7 is outside it); 3.4.0 to 3.4.4 (3.4.5 is outside it)
  • CVE-2025-64183
    Affects 3.2.3 to 3.2.4 (3.2.5 is outside it); 3.3.0 to 3.3.5 (3.3.6 is outside it); 3.4.0 to 3.4.2 (3.4.3 is outside it)
  • CVE-2025-64182
    Affects 3.2.3 to 3.2.4 (3.2.5 is outside it); 3.3.0 to 3.3.5 (3.3.6 is outside it); 3.4.0 to 3.4.2 (3.4.3 is outside it)
  • CVE-2025-64181
    Affects 3.3.0 to 3.3.5 (3.3.6 is outside it); 3.4.0 to 3.4.2 (3.4.3 is outside it)
  • CVE-2025-48074
    Affects 3.3.2 (3.3.3 is outside it)
  • CVE-2025-48073
    Affects 3.3.2 (3.3.3 is outside it)
  • CVE-2025-48072
    Affects 3.3.2 (3.3.3 is outside it)
Show all 15 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 15

  • OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write

    Affected: from 3.2.0, fixed in 3.2.7; from 3.3.0, fixed in 3.3.9; from 3.4.0, fixed in 3.4.9; from 3.2.0, fixed in 3.2.7; from 3.3.0, fixed in 3.3.9; from 3.4.0, fixed in 3.4.9.

    Fixed in 3.2.7 (released Apr 3, 2026, 3 days before disclosure), 3.3.9 (released Apr 3, 2026, 3 days before disclosure) and 3.4.9 (released Apr 3, 2026, 3 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

    Affected: from 3.1.0, fixed in 3.2.7; from 3.3.0, fixed in 3.3.9; from 3.4.0, fixed in 3.4.9; from 3.1.0, fixed in 3.2.7; from 3.3.0, fixed in 3.3.9; from 3.4.0, fixed in 3.4.9.

    Fixed in 3.2.7 (released Apr 3, 2026, 3 days before disclosure), 3.3.9 (released Apr 3, 2026, 3 days before disclosure) and 3.4.9 (released Apr 3, 2026, 3 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)

    Affected: from 3.2.0, fixed in 3.4.8; from 3.4.0, fixed in 3.4.8; from 3.3.0, through 3.3.8; from 3.2.0, through 3.2.6.

    Fixed in 3.4.8 (released Mar 26, 2026, 6 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • OpenEXR: integer overflow to OOB write in uncompress_b44_impl()

    Affected: from 3.2.0, fixed in 3.4.8; from 3.4.0, fixed in 3.4.8; from 3.3.0, through 3.3.8; from 3.2.0, through 3.2.6.

    Fixed in 3.4.8 (released Mar 26, 2026, 6 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

    Affected: from 2.3.0, fixed in 3.2.6; from 3.3.0, fixed in 3.3.8; from 3.4.0, fixed in 3.4.6; from 2.3.0, fixed in 3.2.6; from 3.3.0, fixed in 3.3.8; from 3.4.0, fixed in 3.4.6.

    Fixed in 3.2.6 (released Mar 1, 2026, 2 days before disclosure), 3.3.8 (released Mar 1, 2026, 2 days before disclosure) and 3.4.6 (released Mar 1, 2026, 2 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • CVE-2026-26981Medium 6.5

    OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

    Affected: from 3.3.0, fixed in 3.3.7; from 3.4.0, fixed in 3.4.5; from 3.3.0, fixed in 3.3.7; from 3.4.0, fixed in 3.4.5.

    Fixed in 3.3.7 (released Feb 20, 2026, 4 days before disclosure) and 3.4.5 (released Feb 21, 2026, 3 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • CVE-2025-64183Medium 5.5

    OpenEXR has use after free in PyObject_StealAttrString

    Affected: from 3.2.0, fixed in 3.2.5; from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3; from 3.2.0, fixed in 3.2.5; from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3.

    Fixed in 3.2.5 (released Nov 5, 2025, 5 days before disclosure), 3.3.6 (released Nov 5, 2025, 5 days before disclosure) and 3.4.3 (released Nov 5, 2025, 5 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • CVE-2025-64182Medium 5.5

    OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()

    Affected: from 3.2.0, fixed in 3.2.5; from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3; from 3.2.0, fixed in 3.2.5; from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3.

    Fixed in 3.2.5 (released Nov 5, 2025, 5 days before disclosure), 3.3.6 (released Nov 5, 2025, 5 days before disclosure) and 3.4.3 (released Nov 5, 2025, 5 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • OpenEXR Makes Use of Uninitialized Memory

    Affected: from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3; from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3.

    Fixed in 3.3.6 (released Nov 5, 2025, 5 days before disclosure) and 3.4.3 (released Nov 5, 2025, 5 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • CVE-2025-48074Medium 4.6

    OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors

    Affected: from 3.3.2, fixed in 3.3.3.

    Fixed in 3.3.3 (released Mar 24, 2025, 130 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • CVE-2025-48073Medium 4.6

    OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

    Affected: from 3.3.2, fixed in 3.3.3.

    Fixed in 3.3.3 (released Mar 24, 2025, 129 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • CVE-2025-48072Medium 6.8

    OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap

    Affected: from 3.3.2, fixed in 3.3.3.

    Fixed in 3.3.3 (released Mar 24, 2025, 129 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline Parsing

    Affected: from 3.3.0, fixed in 3.3.3.

    Fixed in 3.3.3 (released Mar 24, 2025, 129 days before disclosure).

    The latest release, 3.5.3, is not affected.

  • In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.

    Affected: fixed in 2.2.1.

    Fixed in 3.2.3 (released Mar 7, 2024, 2482 days after disclosure, the advisory names 2.2.1, which was never published).

    The latest release, 3.5.3, is not affected.

  • In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash…

    Affected: fixed in 2.2.1.

    Fixed in 3.2.3 (released Mar 7, 2024, 2482 days after disclosure, the advisory names 2.2.1, which was never published).

    The latest release, 3.5.3, is not affected.