PT-2026-35475 · Julia · Openexr Jll

Publicado 2026-04-17 · Atualizado 2026-04-17

OSV

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the istream nonparallel read function in ImfContextInit.cpp when parsing a malformed EXR file through a memory-mapped IStream. A signed integer subtraction produces a negative value that is implicitly converted to size t, resulting in a massive length being passed to memcpy. Versions 3.3.7 and 3.4.5 contain a patch.

Identificadores relacionados

JLSEC-2026-140

Produtos afetados

Openexr Jll

Referências · 4

• https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef · Nota
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c · Nota
• https://github.com/AcademySoftwareFoundation/openexr/commit/d2be382758adc3e9ab83a3de35138ec28d93ebd8 · Nota
• https://osv.dev/vulnerability/JLSEC-2026-140 · Aviso do Fabricante