# openexr (PyPI) vulnerabilities 15 known vulnerabilities (6 high, 6 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.5.3 (Oct 31, 2026): no advisory affects it - Newest unaffected release: 3.5.3 (Oct 31, 2026), the latest release - Weekly downloads: 212.8K - Dependents: 64 - Releases: 58 since 1.0.2 (Jul 13, 2009) - Registry: https://pypi.org/project/openexr/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-34589: 3.2.3 to 3.2.6 (3.2.7 is outside it); 3.3.0 to 3.3.8 (3.3.9 is outside it); 3.4.0 to 3.4.8 (3.4.9 is outside it) - CVE-2026-34588: 3.2.3 to 3.2.6 (3.2.7 is outside it); 3.3.0 to 3.3.8 (3.3.9 is outside it); 3.4.0 to 3.4.8 (3.4.9 is outside it) - CVE-2026-34543: 3.2.3 to 3.4.7 (3.4.8 is outside it) - CVE-2026-34544: 3.2.3 to 3.4.7 (3.4.8 is outside it) - CVE-2026-27622: 3.2.3 to 3.2.5 (3.2.6 is outside it); 3.3.0 to 3.3.7 (3.3.8 is outside it); 3.4.0 to 3.4.5 (3.4.6 is outside it) - CVE-2026-26981: 3.3.0 to 3.3.6 (3.3.7 is outside it); 3.4.0 to 3.4.4 (3.4.5 is outside it) - CVE-2025-64183: 3.2.3 to 3.2.4 (3.2.5 is outside it); 3.3.0 to 3.3.5 (3.3.6 is outside it); 3.4.0 to 3.4.2 (3.4.3 is outside it) - CVE-2025-64182: 3.2.3 to 3.2.4 (3.2.5 is outside it); 3.3.0 to 3.3.5 (3.3.6 is outside it); 3.4.0 to 3.4.2 (3.4.3 is outside it) - CVE-2025-64181: 3.3.0 to 3.3.5 (3.3.6 is outside it); 3.4.0 to 3.4.2 (3.4.3 is outside it) - CVE-2025-48074: 3.3.2 (3.3.3 is outside it) - CVE-2025-48073: 3.3.2 (3.3.3 is outside it) - CVE-2025-48072: 3.3.2 (3.3.3 is outside it) - CVE-2025-48071: 3.3.0 to 3.3.2 (3.3.3 is outside it) - CVE-2017-9112: 1.0.2 to 1.3.9 (3.2.3 is outside it) - CVE-2017-9111: 1.0.2 to 1.3.9 (3.2.3 is outside it) ## Advisories (15) ### [CVE-2026-34589](https://cve.now/CVE-2026-34589): OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write - Severity: High 8.4 - Published: Apr 6, 2026 - Affected: from 3.2.0, fixed in 3.2.7; from 3.3.0, fixed in 3.3.9; from 3.4.0, fixed in 3.4.9; from 3.2.0, fixed in 3.2.7; from 3.3.0, fixed in 3.3.9; from 3.4.0, fixed in 3.4.9. - Fixed in 3.2.7 (released Apr 3, 2026, 3 days before disclosure), 3.3.9 (released Apr 3, 2026, 3 days before disclosure) and 3.4.9 (released Apr 3, 2026, 3 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2026-34588](https://cve.now/CVE-2026-34588): OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write - Severity: High 8.6 - Published: Apr 6, 2026 - Affected: from 3.1.0, fixed in 3.2.7; from 3.3.0, fixed in 3.3.9; from 3.4.0, fixed in 3.4.9; from 3.1.0, fixed in 3.2.7; from 3.3.0, fixed in 3.3.9; from 3.4.0, fixed in 3.4.9. - Fixed in 3.2.7 (released Apr 3, 2026, 3 days before disclosure), 3.3.9 (released Apr 3, 2026, 3 days before disclosure) and 3.4.9 (released Apr 3, 2026, 3 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2026-34543](https://cve.now/CVE-2026-34543): OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo\_pxr24\_impl) - Severity: High 8.7 - Published: Apr 1, 2026 - Affected: from 3.2.0, fixed in 3.4.8; from 3.4.0, fixed in 3.4.8; from 3.3.0, through 3.3.8; from 3.2.0, through 3.2.6. - Fixed in 3.4.8 (released Mar 26, 2026, 6 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2026-34544](https://cve.now/CVE-2026-34544): OpenEXR: integer overflow to OOB write in uncompress\_b44\_impl() - Severity: High 8.4 - Published: Apr 1, 2026 - Affected: from 3.2.0, fixed in 3.4.8; from 3.4.0, fixed in 3.4.8; from 3.3.0, through 3.3.8; from 3.2.0, through 3.2.6. - Fixed in 3.4.8 (released Mar 26, 2026, 6 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2026-27622](https://cve.now/CVE-2026-27622): OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write - Severity: High 8.4 - Published: Mar 3, 2026 - Affected: from 2.3.0, fixed in 3.2.6; from 3.3.0, fixed in 3.3.8; from 3.4.0, fixed in 3.4.6; from 2.3.0, fixed in 3.2.6; from 3.3.0, fixed in 3.3.8; from 3.4.0, fixed in 3.4.6. - Fixed in 3.2.6 (released Mar 1, 2026, 2 days before disclosure), 3.3.8 (released Mar 1, 2026, 2 days before disclosure) and 3.4.6 (released Mar 1, 2026, 2 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2026-26981](https://cve.now/CVE-2026-26981): OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp - Severity: Medium 6.5 - Published: Feb 24, 2026 - Affected: from 3.3.0, fixed in 3.3.7; from 3.4.0, fixed in 3.4.5; from 3.3.0, fixed in 3.3.7; from 3.4.0, fixed in 3.4.5. - Fixed in 3.3.7 (released Feb 20, 2026, 4 days before disclosure) and 3.4.5 (released Feb 21, 2026, 3 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2025-64183](https://cve.now/CVE-2025-64183): OpenEXR has use after free in PyObject\_StealAttrString - Severity: Medium 5.5 - Published: Nov 10, 2025 - Affected: from 3.2.0, fixed in 3.2.5; from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3; from 3.2.0, fixed in 3.2.5; from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3. - Fixed in 3.2.5 (released Nov 5, 2025, 5 days before disclosure), 3.3.6 (released Nov 5, 2025, 5 days before disclosure) and 3.4.3 (released Nov 5, 2025, 5 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2025-64182](https://cve.now/CVE-2025-64182): OpenEXR has buffer overflow in PyOpenEXR\_old's channels() and channel() - Severity: Medium 5.5 - Published: Nov 10, 2025 - Affected: from 3.2.0, fixed in 3.2.5; from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3; from 3.2.0, fixed in 3.2.5; from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3. - Fixed in 3.2.5 (released Nov 5, 2025, 5 days before disclosure), 3.3.6 (released Nov 5, 2025, 5 days before disclosure) and 3.4.3 (released Nov 5, 2025, 5 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2025-64181](https://cve.now/CVE-2025-64181): OpenEXR Makes Use of Uninitialized Memory - Severity: Low 2.0 - Published: Nov 10, 2025 - Affected: from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3; from 3.3.0, fixed in 3.3.6; from 3.4.0, fixed in 3.4.3. - Fixed in 3.3.6 (released Nov 5, 2025, 5 days before disclosure) and 3.4.3 (released Nov 5, 2025, 5 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2025-48074](https://cve.now/CVE-2025-48074): OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors - Severity: Medium 4.6 - Published: Aug 1, 2025 - Affected: from 3.3.2, fixed in 3.3.3. - Fixed in 3.3.3 (released Mar 24, 2025, 130 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2025-48073](https://cve.now/CVE-2025-48073): OpenEXR ScanLineProcess::run\_fill NULL Pointer Write In "reduceMemory" Mode - Severity: Medium 4.6 - Published: Jul 31, 2025 - Affected: from 3.3.2, fixed in 3.3.3. - Fixed in 3.3.3 (released Mar 24, 2025, 129 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2025-48072](https://cve.now/CVE-2025-48072): OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap - Severity: Medium 6.8 - Published: Jul 31, 2025 - Affected: from 3.3.2, fixed in 3.3.3. - Fixed in 3.3.3 (released Mar 24, 2025, 129 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2025-48071](https://cve.now/CVE-2025-48071): OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline Parsing - Severity: High 8.4 - Published: Jul 31, 2025 - Affected: from 3.3.0, fixed in 3.3.3. - Fixed in 3.3.3 (released Mar 24, 2025, 129 days before disclosure). - The latest release, 3.5.3, is not affected. ### [CVE-2017-9112](https://cve.now/CVE-2017-9112): In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash. - Severity: Unrated - Published: May 21, 2017 - Affected: fixed in 2.2.1. - Fixed in 3.2.3 (released Mar 7, 2024, 2482 days after disclosure, the advisory names 2.2.1, which was never published). - The latest release, 3.5.3, is not affected. ### [CVE-2017-9111](https://cve.now/CVE-2017-9111): In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash… - Severity: Unrated - Published: May 21, 2017 - Affected: fixed in 2.2.1. - Fixed in 3.2.3 (released Mar 7, 2024, 2482 days after disclosure, the advisory names 2.2.1, which was never published). - The latest release, 3.5.3, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/openexr Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.