openexr has 14 CVEs on record between 2022 and 2026. The busiest recent month was April 2026 with 6. The median CVSS is 7.7 (high), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.7
- Publish → KEV
- —
- Last 90 days
- 0 prev 2
Worst active — by depth score
CVE-2026-42216Critical· 9.1OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry62CVE-2017-9111High· 8.8OpenEXR invalid write49CVE-2026-41142High· 8.8OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry48CVE-2025-64182High· 7.8OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()43CVE-2025-48071High· 7.8OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size43
openexr vulnerabilities
CVEs affecting openexr, newest first. Open any entry for full detail, references, and exploit status.
14 CVEsRSS
CVE-2026-42216Critical· 9.1PoCOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDM…
CVE-2026-41142High· 8.8OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, the…
CVE-2026-34589Medium· 5.0OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write
OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write
CVE-2025-64182High· 7.8OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
CVE-2026-26981Medium· 6.5OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
CVE-2025-64183High· 7.5OpenEXR has use after free in PyObject_StealAttrString
OpenEXR has use after free in PyObject_StealAttrString
CVE-2025-64181High· 7.5OpenEXR Makes Use of Uninitialized Memory
OpenEXR Makes Use of Uninitialized Memory
CVE-2026-34543HighOpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
CVE-2025-48074MediumOpenEXR Out-Of-Memory via Unbounded File Header Values
OpenEXR Out-Of-Memory via Unbounded File Header Values
CVE-2025-48073MediumOpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode
OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode
CVE-2025-48071High· 7.8OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size
OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size
CVE-2025-48072MediumOpenEXR Out of Bounds Heap Read due to Bad Pointer Arithmetic in LossyDctDecoder_execute
OpenEXR Out of Bounds Heap Read due to Bad Pointer Arithmetic in LossyDctDecoder_execute
CVE-2017-9111High· 8.8OpenEXR invalid write
OpenEXR invalid write
CVE-2017-9112Medium· 6.5OpenEXR invalid read
OpenEXR invalid read