AcademySoftwareFoundation openexr.

OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)

• AcademySoftwareFoundation openexr
• Memory corruption
• CWE-20

OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure

• AcademySoftwareFoundation openexr
• Information disclosure
• Memory corruption

OpenEXR: Empty multiView viewFromChannelName file crash

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: exrmetrics deep pixelmode heap buffer overflow

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts

• AcademySoftwareFoundation openexr
• Memory corruption
• Denial of service

OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length

• AcademySoftwareFoundation openexr
• Memory corruption
• CWE-20

OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)

• AcademySoftwareFoundation openexr
• Denial of service

OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS)

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Integer overflow in the HTJ2K decoder leads to heap-buffer-overflow

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

• AcademySoftwareFoundation openexr
• Memory corruption
• CWE-130

OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl()

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR has a signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)

• AcademySoftwareFoundation openexr
• Memory corruption
• CWE-475

OpenEXR has a signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x

• AcademySoftwareFoundation openexr
• Memory corruption

OpenEXR: integer overflow lead to OOB in HTJ2K decoder

• AcademySoftwareFoundation openexr
• Memory corruption
• CWE-1284