SUSE-SU-2026:23604-1: openexr&distro=SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:23604-1 is a vulnerability in openexr&distro=SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 02-09-2026
   PublishedVulnerability first disclosed.
2. 29-09-2026
   Last modifiedVulnerability information updated.

Description

Security update for openexr This update for openexr fixes the following issues: - CVE-2026-59183: unmapped memory access leading to crash due to `int32_t` multiplication overflow in `unpack_sample_table()` when decoding a crafted deep tiled EXR file (bsc#1276428). - CVE-2026-59184: out-of-bounds or use-after-free writes when processing a crafted EXR with a nonzero `dataWindow.min` (bsc#1276849). - CVE-2026-59186: heap out-of-bounds write on 32-bit/ILP32 builds when a crafted tiled EXR is read through the public `TiledRgbaInputFile` RGBA API (bsc#1276850). - CVE-2026-59189: heap out-of-bounds read when processing a deep image that has a non-zero `dataWindow` origin (bsc#1276855). - CVE-2026-59981: heap out-of-bounds read when procesing a deep image that has a non-zero `dataWindow` origin (bsc#1276862). - CVE-2026-59982: out-of-bounds pointer access when processing a crafted deep EXR that has a non-zero `dataWindow` origin (bsc#1276853). - CVE-2026-59983: out-of-bounds read in ILP32 builds when processing a crafted uncompressed deep-tile EXR (bsc#1276856). - CVE-2026-59984: out-of-bounds write in ILP32 builds when processing a crafted B44-compressed scanline EXR (bsc#1276857). - CVE-2026-59985: out-of-bounds read in ILP32 builds when processing a crafted RLE-compressed EXR (bsc#1276858). - CVE-2026-61555: undefined behavior when processing a crafted EXR with an empty `multiView` header attribute (bsc#1276859). - CVE-2026-68515: heap out-of-bounds write in `exrmultiview` when combining two specially crafted, individually valid scanline EXR files whose union `dataWindow` is not aligned to one view's channel subsampling (bsc#1276848).

No weakness data has been published for this record.