# CVE-2026-27622: openexr: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for t... CVE-2026-27622 is fixed in 13 products on 1 platform, first by libopenexr22 2.2.0-11.1ubuntu1.9+esm1, released March 3, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-27622 - Priority: High - CVSS: 7.8 (important) - EPSS: 0.0024 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 3, 2026 ## Description OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | OpenEXR rocky 8 | 0:2.2.0-12.el8_10.1 | [RLSA-2026:8863](https://patchblox.com/security/data/fix/linux/rlsa-2026-8863.md) | Apr 23, 2026 | | Linux | OpenEXR-devel RHEL 8 | 0:2.2.0-12.el8_10.1 | [RHSA-2026:8863](https://patchblox.com/security/data/fix/linux/rhsa-2026-8863.md) | Apr 30, 2026 | | Linux | OpenEXR-devel almalinux 8 | 2.2.0-12.el8_10.1 | [ALSA-2026:8863](https://patchblox.com/security/data/fix/linux/alsa-2026-8863.md) | Apr 20, 2026 | | Linux | OpenEXR-devel ol 8 | 0:2.2.0-12.el8_10.1 | [ELSA-2026-8863](https://patchblox.com/security/data/fix/linux/elsa-2026-8863.md) | Apr 20, 2026 | | Linux | OpenEXR-libs RHEL 8 | 0:2.2.0-12.el8_10.1 | [RHSA-2026:8863](https://patchblox.com/security/data/fix/linux/rhsa-2026-8863.md) | Apr 30, 2026 | | Linux | OpenEXR-libs almalinux 8 | 2.2.0-12.el8_10.1 | [ALSA-2026:8863](https://patchblox.com/security/data/fix/linux/alsa-2026-8863.md) | Apr 20, 2026 | | Linux | OpenEXR-libs ol 8 | 0:2.2.0-12.el8_10.1 | [ELSA-2026-8863](https://patchblox.com/security/data/fix/linux/elsa-2026-8863.md) | Apr 20, 2026 | | Linux | libopenexr-3-1-30 Ubuntu 24.04.5 LTS (noble) | 3.1.5-5.1ubuntu0.1~esm1 | [libopenexr-3-1-30 3.1.5-5.1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libopenexr-3-1-30-3.1.5-5.1ubuntu0.1-esm1.md) | Apr 6, 2026 | | Linux | libopenexr-3-1-30 Ubuntu 26.04.1 LTS (resolute) | 3.1.13-2ubuntu0.26.04.1~esm1 | [libopenexr-3-1-30 3.1.13-2ubuntu0.26.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libopenexr-3-1-30-3.1.13-2ubuntu0.26.04.1-esm1.md) | Apr 6, 2026 | | Linux | libopenexr22 Ubuntu 18.04.6 LTS (bionic) | 2.2.0-11.1ubuntu1.9+esm1 | [libopenexr22 2.2.0-11.1ubuntu1.9+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenexr22-2.2.0-11.1ubuntu1.9-esm1.md) | Mar 3, 2026 | | Linux | libopenexr24 Ubuntu 20.04 LTS (focal) | 2.3.0-6ubuntu0.5+esm2 | [libopenexr24 2.3.0-6ubuntu0.5+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libopenexr24-2.3.0-6ubuntu0.5-esm2.md) | Mar 3, 2026 | | Linux | libopenexr25 Ubuntu 22.04.1 LTS (jammy) | 2.5.7-1ubuntu0.1~esm2 | [libopenexr25 2.5.7-1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libopenexr25-2.5.7-1ubuntu0.1-esm2.md) | Mar 3, 2026 | | Linux | openexr Debian 14 | 3.4.6+ds-1 | [DEBIAN-CVE-2026-27622](https://patchblox.com/security/data/fix/linux/debian-cve-2026-27622.md) | Mar 3, 2026 | | Linux | openexr RHEL 10 | 3.1.10-8.el10_0.1 | [RHSA-2026:7678](https://patchblox.com/security/data/fix/linux/rhsa-2026-7678.md) | Mar 3, 2026 | | Linux | openexr RHEL 9 | 0:3.1.1-3.el9_7.1 | [RHSA-2026:8888](https://patchblox.com/security/data/fix/linux/rhsa-2026-8888.md) | Apr 30, 2026 | | Linux | openexr Ubuntu 18.04.6 LTS (bionic) | 2.2.0-11.1ubuntu1.9+esm1 | [openexr 2.2.0-11.1ubuntu1.9+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openexr-2.2.0-11.1ubuntu1.9-esm1.md) | Mar 3, 2026 | | Linux | openexr Ubuntu 20.04 LTS (focal) | 2.3.0-6ubuntu0.5+esm2 | [openexr 2.3.0-6ubuntu0.5+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openexr-2.3.0-6ubuntu0.5-esm2.md) | Mar 3, 2026 | | Linux | openexr Ubuntu 22.04.1 LTS (jammy) | 2.5.7-1ubuntu0.1~esm2 | [openexr 2.5.7-1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openexr-2.5.7-1ubuntu0.1-esm2.md) | Mar 3, 2026 | | Linux | openexr Ubuntu 24.04.5 LTS (noble) | 3.1.5-5.1ubuntu0.1~esm1 | [openexr 3.1.5-5.1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-openexr-3.1.5-5.1ubuntu0.1-esm1.md) | Apr 6, 2026 | | Linux | openexr Ubuntu 26.04.1 LTS (resolute) | 3.1.13-2ubuntu0.26.04.1~esm1 | [openexr 3.1.13-2ubuntu0.26.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openexr-3.1.13-2ubuntu0.26.04.1-esm1.md) | Apr 6, 2026 | | Linux | openexr almalinux 10 | 3.1.10-8.el10_1.1 | [ALSA-2026:7682](https://patchblox.com/security/data/fix/linux/alsa-2026-7682.md) | Apr 13, 2026 | | Linux | openexr almalinux 9 | 3.1.1-3.el9_7.1 | [ALSA-2026:8888](https://patchblox.com/security/data/fix/linux/alsa-2026-8888.md) | Apr 20, 2026 | | Linux | openexr amzn 2023 | 3.1.5-1.amzn2023.0.7 | [ALAS2023-2026-1481](https://patchblox.com/security/data/fix/linux/alas2023-2026-1481.md) | Mar 16, 2026 | | Linux | openexr ol 10 | 0:3.1.10-8.el10_1.1 | [ELSA-2026-7682](https://patchblox.com/security/data/fix/linux/elsa-2026-7682.md) | Apr 13, 2026 | | Linux | openexr ol 9 | 0:3.1.1-3.el9_7.1 | [ELSA-2026-8888](https://patchblox.com/security/data/fix/linux/elsa-2026-8888.md) | Apr 20, 2026 | | Linux | openexr opensuse-leap 16.0 | 3.2.2-160000.5.1 | [OPENSUSE-SU-2026:20433-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20433-1.md) | Mar 26, 2026 | | Linux | openexr rocky 10 | 0:3.1.10-8.el10_1.1 | [RLSA-2026:7682](https://patchblox.com/security/data/fix/linux/rlsa-2026-7682.md) | Apr 16, 2026 | | Linux | openexr rocky 9 | 0:3.1.1-3.el9_7.1 | [RLSA-2026:8888](https://patchblox.com/security/data/fix/linux/rlsa-2026-8888.md) | Apr 21, 2026 | | Linux | openexr sles 16.0 | 3.2.2-160000.5.1 | [SUSE-SU-2026:20936-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20936-1.md) | Mar 26, 2026 | | Linux | openexr-debuginfo amzn 2023 | 3.1.5-1.amzn2023.0.7 | [ALAS2023-2026-1481](https://patchblox.com/security/data/fix/linux/alas2023-2026-1481.md) | Mar 16, 2026 | | Linux | openexr-debugsource amzn 2023 | 3.1.5-1.amzn2023.0.7 | [ALAS2023-2026-1481](https://patchblox.com/security/data/fix/linux/alas2023-2026-1481.md) | Mar 16, 2026 | | Linux | openexr-devel RHEL 9 | 0:3.1.1-3.el9_7.1 | [RHSA-2026:8888](https://patchblox.com/security/data/fix/linux/rhsa-2026-8888.md) | Apr 30, 2026 | | Linux | openexr-devel almalinux 10 | 3.1.10-8.el10_1.1 | [ALSA-2026:7682](https://patchblox.com/security/data/fix/linux/alsa-2026-7682.md) | Apr 13, 2026 | | Linux | openexr-devel almalinux 9 | 3.1.1-3.el9_7.1 | [ALSA-2026:8888](https://patchblox.com/security/data/fix/linux/alsa-2026-8888.md) | Apr 20, 2026 | | Linux | openexr-devel amzn 2023 | 3.1.5-1.amzn2023.0.7 | [ALAS2023-2026-1481](https://patchblox.com/security/data/fix/linux/alas2023-2026-1481.md) | Mar 16, 2026 | | Linux | openexr-devel ol 10 | 0:3.1.10-8.el10_1.1 | [ELSA-2026-7682](https://patchblox.com/security/data/fix/linux/elsa-2026-7682.md) | Apr 13, 2026 | | Linux | openexr-devel ol 9 | 0:3.1.1-3.el9_7.1 | [ELSA-2026-8888](https://patchblox.com/security/data/fix/linux/elsa-2026-8888.md) | Apr 20, 2026 | | Linux | openexr-libs RHEL 9 | 0:3.1.1-3.el9_7.1 | [RHSA-2026:8888](https://patchblox.com/security/data/fix/linux/rhsa-2026-8888.md) | Apr 30, 2026 | | Linux | openexr-libs almalinux 10 | 3.1.10-8.el10_1.1 | [ALSA-2026:7682](https://patchblox.com/security/data/fix/linux/alsa-2026-7682.md) | Apr 13, 2026 | | Linux | openexr-libs almalinux 9 | 3.1.1-3.el9_7.1 | [ALSA-2026:8888](https://patchblox.com/security/data/fix/linux/alsa-2026-8888.md) | Apr 20, 2026 | | Linux | openexr-libs amzn 2023 | 3.1.5-1.amzn2023.0.7 | [ALAS2023-2026-1481](https://patchblox.com/security/data/fix/linux/alas2023-2026-1481.md) | Mar 16, 2026 | | Linux | openexr-libs ol 10 | 0:3.1.10-8.el10_1.1 | [ELSA-2026-7682](https://patchblox.com/security/data/fix/linux/elsa-2026-7682.md) | Apr 13, 2026 | | Linux | openexr-libs ol 9 | 0:3.1.1-3.el9_7.1 | [ELSA-2026-8888](https://patchblox.com/security/data/fix/linux/elsa-2026-8888.md) | Apr 20, 2026 | | Linux | openexr-libs-debuginfo amzn 2023 | 3.1.5-1.amzn2023.0.7 | [ALAS2023-2026-1481](https://patchblox.com/security/data/fix/linux/alas2023-2026-1481.md) | Mar 16, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.