CVE-2026-61555 json
OpenEXR: Empty multiView viewFromChannelName file crash
published 2026-08-25 2 mo ago modified 2026-09-09 1 mo ago also EUVD-2026-65696
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 6%
- public exploits
- 0
- none known
Summary
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Patch / fix
- openexr Debian 14 3.4.14-0.1
debian advisories DEBIAN-CVE-2026-61555
- openexr SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.2.1-150000.3.55.1
- openexr SLES for SAP applications 16.0, SLES 16.0 3.2.2-160000.10.1
- openexr SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.1.0-6.51.1
suse advisories SUSE-SU-2026:4005-1SUSE-SU-2026:4003-1SUSE-SU-2026:23604-1
- python-OpenEXR openSUSE Tumbleweed 3.4.16-1.1
- openexr openSUSE Leap 16.0 3.2.2-160000.10.1
- openexr openSUSE Tumbleweed 3.4.14-1.1
opensuse advisories openSUSE-SU-2026:12184-1openSUSE-SU-2026:21737-1openSUSE-SU-2026:11612-1
- openexr Alpine 3.24 3.4.15-r0
alpine advisories ALPINE-CVE-2026-61555
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-61555 updated cvss 5.5
OpenEXR: OpenEXR: Denial of Service via crafted EXR image file
-
Red Hat Enterprise Linux 6 OpenEXR-libs, OpenEXR 1.6.1-8.1.el6 Red Hat Enterprise Linux 7 OpenEXR, OpenEXR-libs, OpenEXR 1.6.1-8.1.el6 Red Hat Enterprise Linux 8 OpenEXR-libs, OpenEXR 1.6.1-8.1.el6 Red Hat Enterprise Linux 9 openexr, openexr-libs, openexr 3.1.10-12.el10 Red Hat Enterprise Linux 10 openexr 3.1.10-12.el10affected: workaround, no fix available “Avoid processing untrusted EXR image files from unknown sources. Validate and sanitize EXR files before processing. Consider upgrading to OpenEXR 3.2.11 or later if the deployment context allows.”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Affected products
- AcademySoftwareFoundation openexr
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
- github.com /AcademySoftwareFoundation/openexr/commit/6c6bc2d485f1435d3776b3b4a36f1617cf87070b
- github.com /AcademySoftwareFoundation/openexr/commit/b4257c7740a05071262e496ae7e7efa4774712f5
- github.com /AcademySoftwareFoundation/openexr/commit/c6d3796918f8e358c9c329e909fa6b0dd7dc8cb9
- github.com /AcademySoftwareFoundation/openexr/security/advisories/GHSA-g8f2-r72m-48vx
Sources
- CVE List CVE-2026-61555
- NVD CVE-2026-61555
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.