SUSE-SU-2026:4005-1: openexr&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:4005-1 is a vulnerability in openexr&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 07-09-2026
   PublishedVulnerability first disclosed.
2. 13-09-2026
   Last modifiedVulnerability information updated.

Description

Security update for openexr This update for openexr fixes the following issues: - CVE-2026-59186: On ILP32, the Array2D<Rgba> tile-conversion buffer size calculation overflows, allocates a much smaller heap buffer, and tile decode writes past that allocation (bsc#1276850). - CVE-2026-61555: crashing occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name (bsc#1276859). - CVE-2026-68515: The utility allocates sampled channel storage using a truncated union_width / xSampling, then reads the sampled input through a Slice based on the misaligned union window, producing a heap out-of-bounds write (bsc#1276848).

No weakness data has been published for this record.