Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Academysoftwarefoundation
Openexr

AcademySoftwareFoundation openexr Vulnerabilities: CVEs, CISA KEV & Security Advisories

AcademySoftwareFoundation

51 CVEs

AcademySoftwareFoundation openexr Vulnerabilities

CVE security advisories and vulnerability history for openexr by AcademySoftwareFoundation.

51

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

18

Public exploits

With known exploit

7.0

Avg CVSS

2017–2026

Last updated May 7, 2026

Overview

AcademySoftwareFoundation openexr has 51 published CVE records since 2017, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 18 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting AcademySoftwareFoundation openexr, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of AcademySoftwareFoundation openexr's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High12

Medium10

Low1

28 additional CVEs have no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

0

None of AcademySoftwareFoundation openexr's CVEs are currently listed in CISA's KEV catalog.

Public exploits

18

18 of AcademySoftwareFoundation openexr's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every AcademySoftwareFoundation openexr version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

Fixed in

0ca9b6e855d32a794874b1624581d68fcc3f87c08 CVEs
dcaf5fdb4d1244d8e60a58832cfe9c54734a22577 CVEs
da760aa4b6bee4b9d74b8c6a151221b035fc47b74 CVEs
027f33284f146d91bf983a58c8ea50c36154f3393 CVEs
042c83d28dc8ad754f970800a651509ca61a05703 CVEs
24a1bf50bc59a93e80b0fba8fb2450967baa4de73 CVEs
59fe81b806151d870648f702442b83730e6e64732 CVEs
eae0e337c9f5117e78114fd05f7a415819df413a2 CVEs
0ac2ea34c8f3134148a5df4052e40f155b76f6fb1 CVE
11cad77da87c4fa2aab7d58dd5339e254db7937e1 CVE
14e438dce8e6ebd03bc5564d02cfa97f9be6028a

Find a version

51 CVEs

Sort

OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)
CVE-2026-42217
Public exploit
Patch
CWE-190
Medium · CVSS 6.3
EPSS 0.1% (17th pct)2026-05-07
OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
CVE-2026-42216
Public exploit
Patch
CWE-125
High · CVSS 8.8
EPSS 0.1% (19th pct)2026-05-07
OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
CVE-2026-41142
Patch
CWE-190
High · CVSS 8.8
EPSS 0.0% (11th pct)2026-05-07
OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)
CVE-2026-40250
Patch
CWE-190
High · CVSS 8.4
EPSS 0.0% (10th pct)2026-04-21
OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)
CVE-2026-40244
Patch
CWE-190
High · CVSS 8.4
EPSS 0.0% (10th pct)2026-04-21
OpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl()
CVE-2026-39886
Public exploit
Patch
CWE-190
Medium · CVSS 5.3
EPSS 0.1% (24th pct)2026-04-21
OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write
CVE-2026-34589
Patch
CWE-787
High · CVSS 8.4
EPSS 0.0% (1th pct)2026-04-06
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
CVE-2026-34588
Patch
CWE-787
High · CVSS 8.6
EPSS 0.0% (1th pct)2026-04-06
OpenEXR has a signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression
CVE-2026-34380
Public exploit
Patch
CWE-787
Medium · CVSS 5.9
EPSS 0.1% (22th pct)2026-04-06
OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)
CVE-2026-34379
Public exploit
Patch
CWE-787
High · CVSS 7.1
EPSS 0.1% (26th pct)2026-04-06
OpenEXR has a signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x
CVE-2026-34378
Public exploit
Patch
CWE-190
Medium · CVSS 6.5
EPSS 0.1% (17th pct)2026-04-06
OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
CVE-2026-34543
Public exploit
Patch
CWE-908
High · CVSS 8.7
EPSS 0.0% (6th pct)2026-04-01
OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
CVE-2026-34544
Public exploit
Patch
CWE-190
High · CVSS 8.4
EPSS 0.0% (0th pct)2026-04-01
OpenEXR: integer overflow lead to OOB in HTJ2K decoder
CVE-2026-34545
Public exploit
Patch
CWE-190
High · CVSS 8.4
EPSS 0.0% (9th pct)2026-04-01
OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write
CVE-2026-27622
Patch
CWE-787
High · CVSS 8.4
EPSS 0.0% (7th pct)2026-03-03
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
CVE-2026-26981
Public exploit
Patch
CWE-195
Medium · CVSS 6.5
EPSS 0.0% (7th pct)2026-02-24
OpenEXR has use after free in PyObject_StealAttrString
CVE-2025-64183
Public exploit
Patch
CWE-416
Medium · CVSS 5.5
EPSS 0.1% (21th pct)2025-11-10
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
CVE-2025-64182
Public exploit
Patch
CWE-120
Medium · CVSS 5.5
EPSS 0.0% (6th pct)2025-11-10
OpenEXR Makes Use of Uninitialized Memory
CVE-2025-64181
Public exploit
Patch
CWE-457
Low · CVSS 2.0
EPSS 0.1% (30th pct)2025-11-10
OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors
CVE-2025-48074
Public exploit
Patch
CWE-770
Medium · CVSS 4.6
EPSS 0.1% (32th pct)2025-08-01
OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode
CVE-2025-48073
Public exploit
Patch
CWE-476
Medium · CVSS 4.6
EPSS 0.2% (39th pct)2025-07-31
OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap
CVE-2025-48072
Public exploit
Patch
CWE-125
Medium · CVSS 6.8
EPSS 0.5% (64th pct)2025-07-31
OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline Parsing
CVE-2025-48071
Public exploit
Patch
CWE-122
High · CVSS 8.4
EPSS 0.1% (29th pct)2025-07-31
Vulnerability · 2022-08-23
CVE-2021-20304
Patch
CWE-190
Unscored
EPSS 0.2% (37th pct)2022-08-23
Vulnerability · 2022-08-23
CVE-2021-20298
Patch
CWE-400
Unscored
EPSS 0.2% (48th pct)2022-08-23
Vulnerability · 2022-03-16
CVE-2021-20299
Patch
CWE-476
Unscored
EPSS 1.0% (78th pct)2022-03-16
Vulnerability · 2021-12-31
CVE-2021-45942
Patch
Unscored
EPSS 0.5% (64th pct)2021-12-31
Vulnerability · 2020-12-09
CVE-2020-16589
Patch
Unscored
EPSS 0.5% (68th pct)2020-12-09
Vulnerability · 2020-12-09
CVE-2020-16588
Patch
Unscored
EPSS 0.3% (53th pct)2020-12-09
Vulnerability · 2020-12-09
CVE-2020-16587
Patch
Unscored
EPSS 0.5% (68th pct)2020-12-09

Showing 30 of 51

Common weakness types

The CWE weakness categories most often found in AcademySoftwareFoundation openexr CVEs. Follow any weakness for its full explanation.

CWE-190Integer Overflow or Wraparound9 CVEs
CWE-787Out-of-bounds Write5 CVEs
CWE-476NULL Pointer Dereference2 CVEs
CWE-125Out-of-bounds Read2 CVEs
CWE-416Use After Free1 CVE
CWE-457Use of Uninitialized Variable1 CVE
CWE-770Allocation of Resources Without Limits or Throttling1 CVE
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')1 CVE

Disclosure activity by year

How many AcademySoftwareFoundation openexr CVEs were published each year.

2017

8

2018

2

2020

14

2021

1

2022

3

2025

7

2026

16

Other AcademySoftwareFoundation products

Browse vulnerabilities for other products by AcademySoftwareFoundation.

OpenImageIO10 CVEs MaterialX4 CVEs OpenColorIO1 CVEs

All AcademySoftwareFoundation vulnerabilities

Frequently asked questions

Common questions about AcademySoftwareFoundation openexr vulnerabilities.

How many CVEs does AcademySoftwareFoundation openexr have?

AcademySoftwareFoundation openexr has 51 published CVE records since 2017.

How many AcademySoftwareFoundation openexr CVEs are in CISA KEV?

None of AcademySoftwareFoundation openexr's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for AcademySoftwareFoundation openexr vulnerabilities?

Yes — 18 of AcademySoftwareFoundation openexr's CVEs have a known public exploit.

Which versions of AcademySoftwareFoundation openexr are affected?

138 distinct AcademySoftwareFoundation openexr versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in AcademySoftwareFoundation openexr CVEs?

AcademySoftwareFoundation openexr's CVEs most often map to these CWE weakness types: CWE-190 (Integer Overflow or Wraparound), CWE-787 (Out-of-bounds Write), CWE-476 (NULL Pointer Dereference), CWE-125 (Out-of-bounds Read).

What is the average severity of AcademySoftwareFoundation openexr CVEs?

The average CVSS base score across AcademySoftwareFoundation openexr's scored CVEs is 7.0.

References

All AcademySoftwareFoundation vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track AcademySoftwareFoundation openexr vulnerabilities

Monitor new AcademySoftwareFoundation openexr vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References

1 CVE

1899a456cbafb213c4a53c35eb3203296f92e5031 CVE

25e9515b06a6bc293d871622b8cafaee7af84e0f1 CVE

3fad448f2c98c70a2f6403566a664e32bbe770f81 CVE

51a92d67f53c08230734e74564c807043cbfe41e1 CVE

6bb36714528a9563dd3b92720c5063a1284b86f81 CVE

74504503cff86e986bac441213c403b0ba28d58f1 CVE

85fd638ae0d5fa132434f4cbf32590261c1dba971 CVE

8b5370c688a7362673c3a5256d93695617a4cd9a1 CVE

916cc729e24aa16b86d82813f6e136340ab2876f1 CVE

d19b2c3c0bc884a2837e2a60b1caa23dcb5b32961 CVE

d2b41c84abedf3af0c3b5f2494299037acfa98c31 CVE

d7605f5990900cff8024f1fb36ffb0912d340b521 CVE

db217f29dfb24f6b4b5100c24ac5e7490e1c57d01 CVE

e94d82b2165da4e2af167aa74630906202e3d43b1 CVE