CLSA-2026-1792627161
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792627161.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1792627161
- Upstream
- Published
- 2026-10-21T23:59:41Z
- Modified
- 2026-10-26T09:31:01Z
- Summary
- openexr: Fix of 11 CVEs
- Details
-
- CVE-2026-54920: validate the data window and pre-initialise every level pointer in OpenEXRUtil Image::resize(), so an overflowing level size no longer leaves clearLevels() deleting uninitialised ImageLevel pointers
- CVE-2026-55059: map the row index with dataWindow.min.y instead of min.x in SampleCountChannel::set(int, unsigned int[]) and bounds-check the per-pixel setter, so a valid row no longer writes before the sample-count buffer
- CVE-2026-55373: reject sample counts above 0x80000000 in roundListSizeUp(), so the unsigned shift loop can no longer wrap to zero and spin forever
- CVE-2026-59183: widen the chunk width, height and row index to int64_t in unpack_sample_table(), so a large deep tile no longer overflows the sample-table index arithmetic and reads unmapped memory
- CVE-2026-59184: index the TypedFlatImageChannel row() accessors from the compact _pixels array instead of the absolute-coordinate _base pointer, so writing rows of an image with a non-zero data window origin no longer writes outside the pixel buffer
- CVE-2026-59186: validate Array/Array2D dimensions and compute the Array2D element count in 64-bit arithmetic, so an oversized tile no longer under-allocates the Rgba conversion buffer on ILP32 builds
- CVE-2026-59189: index the TypedDeepImageChannel row() accessors from the compact _sampleListPointers array instead of the absolute-coordinate _base pointer, so reading rows of a deep image with a non-zero data window origin no longer reads outside the sample-list pointer buffer
- CVE-2026-59981: index SampleCountChannel::row() from the compact _numSamples array instead of the absolute-coordinate _base pointer, so row(0) stays inside the allocation for a deep image with a non-zero data window origin
- CVE-2026-59983: compute the deep sample-count table size in uint64_t and reject a truncating conversion in update_pack_unpack_ptrs(), so an ILP32 build no longer allocates a wrapped-to-zero table
- CVE-2026-59984: reject a scratch-buffer size that does not survive the conversion to size_t in internal_exr_undo_b44() and internal_exr_undo_b44a(), so B44/B44A decode no longer writes past a truncated ILP32 allocation
- CVE-2026-61555: return defaultViewName() instead of multiView[0] in viewFromChannelName(), so a crafted empty multiView attribute no longer indexes an empty vector
- References
-
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792627161.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-54920
- https://nvd.nist.gov/vuln/detail/CVE-2026-55059
- https://nvd.nist.gov/vuln/detail/CVE-2026-55373
- https://nvd.nist.gov/vuln/detail/CVE-2026-59183
- https://nvd.nist.gov/vuln/detail/CVE-2026-59184
- https://nvd.nist.gov/vuln/detail/CVE-2026-59186
- https://nvd.nist.gov/vuln/detail/CVE-2026-59189
- https://nvd.nist.gov/vuln/detail/CVE-2026-59981
- https://nvd.nist.gov/vuln/detail/CVE-2026-59983
- https://nvd.nist.gov/vuln/detail/CVE-2026-59984
- https://nvd.nist.gov/vuln/detail/CVE-2026-61555
Affected packages
TuxCare:AlmaLinux:9.2 / openexr
Package
- Name
- openexr
- Purl
- pkg:rpm/tuxcare/openexr?distro=almalinux-9.2
TuxCare:AlmaLinux:9.2 / openexr-devel
Package
- Name
- openexr-devel
- Purl
- pkg:rpm/tuxcare/openexr-devel?distro=almalinux-9.2