# CVE-2026-68515: openexr: OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture... CVE-2026-68515 is fixed in 9 products on 1 platform, first by DEBIAN-CVE-2026-68515, released August 28, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-68515 - Priority: High - CVSS: 7.1 (high) - EPSS: 0.0019 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 25, 2026 ## Description OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied, individually valid scanline EXR files whose union dataWindow is not aligned to one view's channel subsampling. The utility allocates sampled channel storage using a truncated union_width / xSampling, then reads the sampled input through a Slice based on the misaligned union window, producing a heap out-of-bounds write. The trigger is normal public-tool processing, such as exrmultiview left A.exr right B.exr out.exr with crafted but valid inputs, so this is not solely an API or caller-precondition issue. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | OpenEXR rocky 8 | 0:2.2.0-12.el8_10.3 | [RLSA-2026:82345](https://patchblox.com/security/data/fix/linux/rlsa-2026-82345.md) | Nov 7, 2026 | | Linux | OpenEXR-devel RHEL 8 | 0:2.2.0-12.el8_10.3 | [RHSA-2026:82345](https://patchblox.com/security/data/fix/linux/rhsa-2026-82345.md) | Oct 16, 2026 | | Linux | OpenEXR-devel almalinux 8 | 2.2.0-12.el8_10.3 | [ALSA-2026:82345](https://patchblox.com/security/data/fix/linux/alsa-2026-82345.md) | Nov 7, 2026 | | Linux | OpenEXR-devel ol 8 | 0:2.2.0-12.el8_10.3 | [ELSA-2026-82345](https://patchblox.com/security/data/fix/linux/elsa-2026-82345.md) | Nov 7, 2026 | | Linux | OpenEXR-libs RHEL 8 | 0:2.2.0-12.el8_10.3 | [RHSA-2026:82345](https://patchblox.com/security/data/fix/linux/rhsa-2026-82345.md) | Oct 16, 2026 | | Linux | OpenEXR-libs almalinux 8 | 2.2.0-12.el8_10.3 | [ALSA-2026:82345](https://patchblox.com/security/data/fix/linux/alsa-2026-82345.md) | Nov 7, 2026 | | Linux | OpenEXR-libs ol 8 | 0:2.2.0-12.el8_10.3 | [ELSA-2026-82345](https://patchblox.com/security/data/fix/linux/elsa-2026-82345.md) | Nov 7, 2026 | | Linux | openexr Debian 14 | 3.4.14-0.1 | [DEBIAN-CVE-2026-68515](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68515.md) | Aug 28, 2026 | | Linux | openexr RHEL 10 | 3.1.10-8.el10_2.4 | [RHSA-2026:69609](https://patchblox.com/security/data/fix/linux/rhsa-2026-69609.md) | Sep 22, 2026 | | Linux | openexr RHEL 9 | 0:3.1.1-3.el9_8.4 | [RHSA-2026:69608](https://patchblox.com/security/data/fix/linux/rhsa-2026-69608.md) | Sep 22, 2026 | | Linux | openexr almalinux 10 | 3.1.10-8.el10_2.4 | [ALSA-2026:69609](https://patchblox.com/security/data/fix/linux/alsa-2026-69609.md) | Sep 21, 2026 | | Linux | openexr almalinux 9 | 3.1.1-3.el9_8.4 | [ALSA-2026:69608](https://patchblox.com/security/data/fix/linux/alsa-2026-69608.md) | Sep 21, 2026 | | Linux | openexr amzn 2023 | 3.1.5-1.amzn2023.0.12 | [ALAS2023-2026-2154](https://patchblox.com/security/data/fix/linux/alas2023-2026-2154.md) | Sep 14, 2026 | | Linux | openexr ol 10 | 0:3.1.10-8.el10_2.4 | [ELSA-2026-69609](https://patchblox.com/security/data/fix/linux/elsa-2026-69609.md) | Sep 24, 2026 | | Linux | openexr ol 9 | 0:3.1.1-3.el9_8.4 | [ELSA-2026-69608](https://patchblox.com/security/data/fix/linux/elsa-2026-69608.md) | Sep 22, 2026 | | Linux | openexr opensuse-leap 16.0 | 3.2.2-160000.10.1 | [OPENSUSE-SU-2026:21737-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21737-1.md) | Sep 2, 2026 | | Linux | openexr rocky 10 | 0:3.1.10-8.el10_2.4 | [RLSA-2026:69609](https://patchblox.com/security/data/fix/linux/rlsa-2026-69609.md) | Sep 23, 2026 | | Linux | openexr rocky 9 | 0:3.1.1-3.el9_8.4 | [RLSA-2026:69608](https://patchblox.com/security/data/fix/linux/rlsa-2026-69608.md) | Sep 23, 2026 | | Linux | openexr sles 15.6 | 2.2.1-150000.3.55.1 | [SUSE-SU-2026:4003-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4003-1.md) | Sep 7, 2026 | | Linux | openexr sles 15.7 | 2.2.1-150000.3.55.1 | [SUSE-SU-2026:4003-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4003-1.md) | Sep 7, 2026 | | Linux | openexr sles 16.0 | 3.2.2-160000.10.1 | [SUSE-SU-2026:23604-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23604-1.md) | Sep 2, 2026 | | Linux | openexr-debuginfo amzn 2023 | 3.1.5-1.amzn2023.0.12 | [ALAS2023-2026-2154](https://patchblox.com/security/data/fix/linux/alas2023-2026-2154.md) | Sep 14, 2026 | | Linux | openexr-debugsource amzn 2023 | 3.1.5-1.amzn2023.0.12 | [ALAS2023-2026-2154](https://patchblox.com/security/data/fix/linux/alas2023-2026-2154.md) | Sep 14, 2026 | | Linux | openexr-devel RHEL 9 | 0:3.1.1-3.el9_8.4 | [RHSA-2026:69608](https://patchblox.com/security/data/fix/linux/rhsa-2026-69608.md) | Sep 22, 2026 | | Linux | openexr-devel almalinux 10 | 3.1.10-8.el10_2.4 | [ALSA-2026:69609](https://patchblox.com/security/data/fix/linux/alsa-2026-69609.md) | Sep 21, 2026 | | Linux | openexr-devel almalinux 9 | 3.1.1-3.el9_8.4 | [ALSA-2026:69608](https://patchblox.com/security/data/fix/linux/alsa-2026-69608.md) | Sep 21, 2026 | | Linux | openexr-devel amzn 2023 | 3.1.5-1.amzn2023.0.12 | [ALAS2023-2026-2154](https://patchblox.com/security/data/fix/linux/alas2023-2026-2154.md) | Sep 14, 2026 | | Linux | openexr-devel ol 10 | 0:3.1.10-8.el10_2.4 | [ELSA-2026-69609](https://patchblox.com/security/data/fix/linux/elsa-2026-69609.md) | Sep 24, 2026 | | Linux | openexr-devel ol 9 | 0:3.1.1-3.el9_8.4 | [ELSA-2026-69608](https://patchblox.com/security/data/fix/linux/elsa-2026-69608.md) | Sep 22, 2026 | | Linux | openexr-libs RHEL 9 | 0:3.1.1-3.el9_8.4 | [RHSA-2026:69608](https://patchblox.com/security/data/fix/linux/rhsa-2026-69608.md) | Sep 22, 2026 | | Linux | openexr-libs almalinux 10 | 3.1.10-8.el10_2.4 | [ALSA-2026:69609](https://patchblox.com/security/data/fix/linux/alsa-2026-69609.md) | Sep 21, 2026 | | Linux | openexr-libs almalinux 9 | 3.1.1-3.el9_8.4 | [ALSA-2026:69608](https://patchblox.com/security/data/fix/linux/alsa-2026-69608.md) | Sep 21, 2026 | | Linux | openexr-libs amzn 2023 | 3.1.5-1.amzn2023.0.12 | [ALAS2023-2026-2154](https://patchblox.com/security/data/fix/linux/alas2023-2026-2154.md) | Sep 14, 2026 | | Linux | openexr-libs ol 10 | 0:3.1.10-8.el10_2.4 | [ELSA-2026-69609](https://patchblox.com/security/data/fix/linux/elsa-2026-69609.md) | Sep 24, 2026 | | Linux | openexr-libs ol 9 | 0:3.1.1-3.el9_8.4 | [ELSA-2026-69608](https://patchblox.com/security/data/fix/linux/elsa-2026-69608.md) | Sep 22, 2026 | | Linux | openexr-libs-debuginfo amzn 2023 | 3.1.5-1.amzn2023.0.12 | [ALAS2023-2026-2154](https://patchblox.com/security/data/fix/linux/alas2023-2026-2154.md) | Sep 14, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.