Home / mailings [SECURITY] [DSA 6618-1] openexr security update
Posted on 11 November 2026
Debian Security Advisory- -------------------------------------------------------------------------
Debian Security Advisory DSA-6618-1 security@debian.org
https://www.debian.org/security/ Aron Xu
November 11, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : openexr
CVE ID : CVE-2026-27622 CVE-2026-34379 CVE-2026-34380 CVE-2026-34543
CVE-2026-34544 CVE-2026-34588 CVE-2026-34589 CVE-2026-40244
CVE-2026-40250 CVE-2026-41142 CVE-2026-42216 CVE-2026-42217
CVE-2026-54920 CVE-2026-55059 CVE-2026-55373 CVE-2026-59183
CVE-2026-59184 CVE-2026-59186 CVE-2026-59189 CVE-2026-59981
CVE-2026-59982 CVE-2026-59983 CVE-2026-59984 CVE-2026-59985
CVE-2026-61555 CVE-2026-68515
Multiple vulnerabilities were discovered in OpenEXR, a library for handling
high dynamic range images. Processing malformed image files could cause
denial of service or out-of-bounds memory reads and writes.
This update moves to OpenEXR 3.2 series while retaining compatibility with
the existing Debian trixie library ABI.
For the stable distribution (trixie), these problems have been fixed in
version 3.2.12-1~deb13u1.
We recommend that you upgrade your openexr packages.
For the detailed security status of openexr please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openexr
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
