CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 07:30 UTC )
This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,443 Show in the list Critical, last 7 days 355 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product academysoftwarefoundation:openexr . Show all products
22 CVEs, showing 1 to 22
CVE Severity Title Published CVE-2026-59981 High 7.1 OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow Assigned by GitHub_M
Aug 25, 2026 CVE-2026-68514 Medium 5.5 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images Assigned by GitHub_M
Aug 25, 2026 CVE-2026-68515 High 7.1 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union Assigned by GitHub_M
Aug 25, 2026 CVE-2026-68513 High 7.1 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision Assigned by GitHub_M
Aug 25, 2026 CVE-2026-65979 Medium 6.7 OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN) Assigned by GitHub_M
Aug 25, 2026 CVE-2026-62986 Medium 4.3 OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure Assigned by GitHub_M
Aug 25, 2026 CVE-2026-61555 Medium 5.5 OpenEXR: Empty multiView viewFromChannelName file crash Assigned by GitHub_M
Aug 25, 2026 CVE-2026-59985 Medium 5.5 OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32 Assigned by GitHub_M
Aug 25, 2026 CVE-2026-59984 Medium 5.5 OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32 Assigned by GitHub_M
Aug 25, 2026 CVE-2026-59983 Medium 5.5 OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32 Assigned by GitHub_M
Aug 25, 2026 CVE-2026-59982 High 7.1 OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms Assigned by GitHub_M
Aug 25, 2026 CVE-2026-59189 High 7.1 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin Assigned by GitHub_M
Aug 25, 2026 CVE-2026-59187 High 7.1 OpenEXR: exrmetrics deep pixelmode heap buffer overflow Assigned by GitHub_M
Aug 25, 2026 CVE-2026-59186 High 7.1 OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds Assigned by GitHub_M
Aug 25, 2026 CVE-2026-59184 High 7.1 OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write Assigned by GitHub_M
Aug 25, 2026 CVE-2026-59183 Medium 5.5 OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding Assigned by GitHub_M
Aug 25, 2026 CVE-2026-55373 Medium 6.2 OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts Assigned by GitHub_M
Aug 25, 2026 CVE-2026-55371 Medium 6.9 OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length Assigned by GitHub_M
Aug 25, 2026 CVE-2026-55059 Medium 6.1 OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability Assigned by GitHub_M
Aug 25, 2026 CVE-2026-54920 None 0.0 OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize Assigned by GitHub_M
Aug 25, 2026 CVE-2026-53532 High 7.1 OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) Assigned by GitHub_M
Aug 24, 2026 CVE-2026-68516 Medium 6.5 OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow Assigned by GitHub_M
Aug 24, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
