# AcademySoftwareFoundation openexr. Every CVE that names AcademySoftwareFoundation openexr among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow](https://agentprime.io/advisories/CVE-2026-59981.md) `CVE-2026-59981` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images](https://agentprime.io/advisories/CVE-2026-68514.md) `CVE-2026-68514` · CVE record: AcademySoftwareFoundation openexr · CVSS 5.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union](https://agentprime.io/advisories/CVE-2026-68515.md) `CVE-2026-68515` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision](https://agentprime.io/advisories/CVE-2026-68513.md) `CVE-2026-68513` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)](https://agentprime.io/advisories/CVE-2026-65979.md) `CVE-2026-65979` · CVE record: AcademySoftwareFoundation openexr · CVSS 6.7 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption, CWE-20 - [OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure](https://agentprime.io/advisories/CVE-2026-62986.md) `CVE-2026-62986` · CVE record: AcademySoftwareFoundation openexr · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure, Memory corruption - [OpenEXR: Empty multiView viewFromChannelName file crash](https://agentprime.io/advisories/CVE-2026-61555.md) `CVE-2026-61555` · CVE record: AcademySoftwareFoundation openexr · CVSS 5.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32](https://agentprime.io/advisories/CVE-2026-59985.md) `CVE-2026-59985` · CVE record: AcademySoftwareFoundation openexr · CVSS 5.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32](https://agentprime.io/advisories/CVE-2026-59984.md) `CVE-2026-59984` · CVE record: AcademySoftwareFoundation openexr · CVSS 5.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32](https://agentprime.io/advisories/CVE-2026-59983.md) `CVE-2026-59983` · CVE record: AcademySoftwareFoundation openexr · CVSS 5.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms](https://agentprime.io/advisories/CVE-2026-59982.md) `CVE-2026-59982` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin](https://agentprime.io/advisories/CVE-2026-59189.md) `CVE-2026-59189` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: exrmetrics deep pixelmode heap buffer overflow](https://agentprime.io/advisories/CVE-2026-59187.md) `CVE-2026-59187` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds](https://agentprime.io/advisories/CVE-2026-59186.md) `CVE-2026-59186` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write](https://agentprime.io/advisories/CVE-2026-59184.md) `CVE-2026-59184` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding](https://agentprime.io/advisories/CVE-2026-59183.md) `CVE-2026-59183` · CVE record: AcademySoftwareFoundation openexr · CVSS 5.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts](https://agentprime.io/advisories/CVE-2026-55373.md) `CVE-2026-55373` · CVE record: AcademySoftwareFoundation openexr · CVSS 6.2 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption, Denial of service - [OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length](https://agentprime.io/advisories/CVE-2026-55371.md) `CVE-2026-55371` · CVE record: AcademySoftwareFoundation openexr · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption, CWE-20 - [OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability](https://agentprime.io/advisories/CVE-2026-55059.md) `CVE-2026-55059` · CVE record: AcademySoftwareFoundation openexr · CVSS 6.1 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize](https://agentprime.io/advisories/CVE-2026-54920.md) `CVE-2026-54920` · CVE record: AcademySoftwareFoundation openexr · CVSS 0.0 None · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)](https://agentprime.io/advisories/CVE-2026-53532.md) `CVE-2026-53532` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service - [OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow](https://agentprime.io/advisories/CVE-2026-68516.md) `CVE-2026-68516` · CVE record: AcademySoftwareFoundation openexr · CVSS 6.5 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Memory corruption - [OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS)](https://agentprime.io/advisories/CVE-2026-45696.md) `CVE-2026-45696` · CVE record: AcademySoftwareFoundation openexr · CVSS 8.3 High · Not analysed yet · Published 18 Jun 2026 · Tags: Memory corruption - [OpenEXR: Integer overflow in the HTJ2K decoder leads to heap-buffer-overflow](https://agentprime.io/advisories/CVE-2026-44663.md) `CVE-2026-44663` · CVE record: AcademySoftwareFoundation openexr · CVSS 6.1 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Memory corruption - [OpenEXR: Shift exponent overflow in \`readVariableLengthInteger()\` (\`ImfIDManifest.cpp\`)](https://agentprime.io/advisories/CVE-2026-42217.md) `CVE-2026-42217` · CVE record: AcademySoftwareFoundation openexr · CVSS 6.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: Memory corruption - [OpenEXR: Out-of-bounds read in \`IDManifest::init()\` during prefix expansion](https://agentprime.io/advisories/CVE-2026-42216.md) `CVE-2026-42216` · CVE record: AcademySoftwareFoundation openexr · CVSS 8.8 High · Not analysed yet · Published 7 May 2026 · Tags: Memory corruption, CWE-130 - [OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API](https://agentprime.io/advisories/CVE-2026-41142.md) `CVE-2026-41142` · CVE record: AcademySoftwareFoundation openexr · CVSS 8.8 High · Not analysed yet · Published 7 May 2026 · Tags: Memory corruption - [OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)](https://agentprime.io/advisories/CVE-2026-40250.md) `CVE-2026-40250` · CVE record: AcademySoftwareFoundation openexr · CVSS 8.4 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption - [OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)](https://agentprime.io/advisories/CVE-2026-40244.md) `CVE-2026-40244` · CVE record: AcademySoftwareFoundation openexr · CVSS 8.4 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption - [OpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl()](https://agentprime.io/advisories/CVE-2026-39886.md) `CVE-2026-39886` · CVE record: AcademySoftwareFoundation openexr · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption - [OpenEXR has a signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression](https://agentprime.io/advisories/CVE-2026-34380.md) `CVE-2026-34380` · CVE record: AcademySoftwareFoundation openexr · CVSS 5.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Memory corruption - [OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)](https://agentprime.io/advisories/CVE-2026-34379.md) `CVE-2026-34379` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 6 Apr 2026 · Tags: Memory corruption, CWE-475, CWE-704 - [OpenEXR has a signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x](https://agentprime.io/advisories/CVE-2026-34378.md) `CVE-2026-34378` · CVE record: AcademySoftwareFoundation openexr · CVSS 6.5 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Memory corruption - [OpenEXR: integer overflow lead to OOB in HTJ2K decoder](https://agentprime.io/advisories/CVE-2026-34545.md) `CVE-2026-34545` · CVE record: AcademySoftwareFoundation openexr · CVSS 8.4 High · Not analysed yet · Published 1 Apr 2026 · Tags: Memory corruption, CWE-1284 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .