CVE-2026-61555
- Source
- https://cve.org/CVERecord?id=CVE-2026-61555
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61555.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-61555
- Aliases
-
- GHSA-g8f2-r72m-48vx
- Downstream
AZL (1)
BELL (1)
DEBIAN (1)
ECHO (1)
MINI (1)
UBUNTU (1)
- Related
- Published
- 2026-08-25T18:19:30Z
- Modified
- 2026-10-28T11:11:59Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- OpenEXR: Empty multiView viewFromChannelName file crash
- Details
-
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61555.json" }- References
-
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-g8f2-r72m-48vx
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61555.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-61555
- https://github.com/AcademySoftwareFoundation/openexr/commit/6c6bc2d485f1435d3776b3b4a36f1617cf87070b
- https://github.com/AcademySoftwareFoundation/openexr/commit/b4257c7740a05071262e496ae7e7efa4774712f5
- https://github.com/AcademySoftwareFoundation/openexr/commit/c6d3796918f8e358c9c329e909fa6b0dd7dc8cb9
Affected packages
Git / github.com/academysoftwarefoundation/openexr
Affected ranges
- Type
- GIT
- Repo
- https://github.com/academysoftwarefoundation/openexr
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "3.2.11" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "3.3.0" }, { "fixed": "3.3.13" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "3.4.0" }, { "fixed": "3.4.14" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "6c6bc2d485f1435d3776b3b4a36f1617cf87070b" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "b4257c7740a05071262e496ae7e7efa4774712f5" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "c6d3796918f8e358c9c329e909fa6b0dd7dc8cb9" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
Other
OPENEXR_1_0_4
v1.*
v1.7.1
v2.*
v2.0.0
v2.0.0.GM
v2.0.1
v2.1.0
v2.3.0
v2.4.0
v2.4.0-beta.1
v2.5.0
v3.*
v3.0.0-beta
v3.2.0
v3.2.0-rc
v3.2.0-rc2
v3.2.0-rc3
v3.2.0-rc4
v3.2.1
v3.2.1-rc
v3.2.10
v3.2.10-rc
v3.2.2
v3.2.2-rc
v3.2.2-rc2
v3.2.3
v3.2.3-rc
v3.2.3-rc2
v3.2.4
v3.2.4-rc
v3.2.4-rc2
v3.2.5
v3.2.5-rc
v3.2.6
v3.2.6-rc
v3.2.7
v3.2.7-rc
v3.2.8
v3.2.8-rc
v3.2.9
v3.2.9-rc
v3.3.0
v3.3.0-rc2
v3.3.1
v3.3.1-rc
v3.3.10
v3.3.10-rc
v3.3.10-rc2
v3.3.11
v3.3.11-rc3
v3.3.12
v3.3.12-rc
v3.3.2
v3.3.2-rc
v3.3.2-rc2
v3.3.2-rc3
v3.3.2-rc4
v3.3.3
v3.3.3-rc
v3.3.3-rc1
v3.3.4
v3.3.4-rc
v3.3.5
v3.3.5-rc
v3.3.5-rc3
v3.3.6
v3.3.6-rc
v3.3.6-rc2
v3.3.6-rc3
v3.3.6-rc4
v3.3.7
v3.3.7-rc
v3.3.7-rc2
v3.3.7-rc3
v3.3.7-rc4
v3.3.8
v3.3.8-rc
v3.3.9
v3.3.9-rc
v3.3.9-rc2
v3.4.0
v3.4.1
v3.4.1-rc
v3.4.1-rc2
v3.4.10
v3.4.10-rc
v3.4.11
v3.4.11-rc
v3.4.11-rc2
v3.4.11-rc3
v3.4.12
v3.4.12-rc2
v3.4.13
v3.4.13-rc
v3.4.13-rc2
v3.4.13-rc3
v3.4.2
v3.4.2-rc
v3.4.2-rc2
v3.4.3
v3.4.3-rc
v3.4.3-rc2
v3.4.3-rc3
v3.4.4
v3.4.4-rc
v3.4.4-rc2
v3.4.5
v3.4.5-rc
v3.4.6
v3.4.6-rc
v3.4.7
v3.4.7-rc
v3.4.8
v3.4.8-rc
v3.4.9
v3.4.9-rc
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61555.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "194206208001756026149579965062045844499",
"length": 5736
},
"id": "CVE-2026-61555-0652a894",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/c6d3796918f8e358c9c329e909fa6b0dd7dc8cb9",
"target": {
"file": "src/test/OpenEXRTest/testMultiView.cpp",
"function": "testMultiViewFunctions"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "194206208001756026149579965062045844499",
"length": 5736
},
"id": "CVE-2026-61555-078555eb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/6c6bc2d485f1435d3776b3b4a36f1617cf87070b",
"target": {
"file": "src/test/OpenEXRTest/testMultiView.cpp",
"function": "testMultiViewFunctions"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "194206208001756026149579965062045844499",
"length": 5736
},
"id": "CVE-2026-61555-0b490d33",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/b4257c7740a05071262e496ae7e7efa4774712f5",
"target": {
"file": "src/test/OpenEXRTest/testMultiView.cpp",
"function": "testMultiViewFunctions"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"58398380024178887413841361653194485349",
"279493557727297240738997372926959995087",
"87420151808560202811921116328708190440",
"226193428927497753752668504259109877229"
],
"threshold": 0.9
},
"id": "CVE-2026-61555-1a33ec4d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/6c6bc2d485f1435d3776b3b4a36f1617cf87070b",
"target": {
"file": "src/lib/OpenEXR/ImfMultiView.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "325024308478623907930938236335110348700",
"length": 319
},
"id": "CVE-2026-61555-381245ef",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/6c6bc2d485f1435d3776b3b4a36f1617cf87070b",
"target": {
"file": "src/lib/OpenEXR/ImfMultiView.cpp",
"function": "viewFromChannelName"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"308793900756395162629517362322602672634",
"18911806130687362032875023893033004178",
"148361498291604064070877928370398191753"
],
"threshold": 0.9
},
"id": "CVE-2026-61555-406ea671",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/c6d3796918f8e358c9c329e909fa6b0dd7dc8cb9",
"target": {
"file": "src/test/OpenEXRTest/testMultiView.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"58398380024178887413841361653194485349",
"279493557727297240738997372926959995087",
"87420151808560202811921116328708190440",
"226193428927497753752668504259109877229"
],
"threshold": 0.9
},
"id": "CVE-2026-61555-50e5bafe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/b4257c7740a05071262e496ae7e7efa4774712f5",
"target": {
"file": "src/lib/OpenEXR/ImfMultiView.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "325024308478623907930938236335110348700",
"length": 319
},
"id": "CVE-2026-61555-8253b10d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/b4257c7740a05071262e496ae7e7efa4774712f5",
"target": {
"file": "src/lib/OpenEXR/ImfMultiView.cpp",
"function": "viewFromChannelName"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"308793900756395162629517362322602672634",
"18911806130687362032875023893033004178",
"148361498291604064070877928370398191753"
],
"threshold": 0.9
},
"id": "CVE-2026-61555-9333df03",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/b4257c7740a05071262e496ae7e7efa4774712f5",
"target": {
"file": "src/test/OpenEXRTest/testMultiView.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "325024308478623907930938236335110348700",
"length": 319
},
"id": "CVE-2026-61555-c1d4f50c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/c6d3796918f8e358c9c329e909fa6b0dd7dc8cb9",
"target": {
"file": "src/lib/OpenEXR/ImfMultiView.cpp",
"function": "viewFromChannelName"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"58398380024178887413841361653194485349",
"279493557727297240738997372926959995087",
"87420151808560202811921116328708190440",
"226193428927497753752668504259109877229"
],
"threshold": 0.9
},
"id": "CVE-2026-61555-d3beebbc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/c6d3796918f8e358c9c329e909fa6b0dd7dc8cb9",
"target": {
"file": "src/lib/OpenEXR/ImfMultiView.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"308793900756395162629517362322602672634",
"18911806130687362032875023893033004178",
"148361498291604064070877928370398191753"
],
"threshold": 0.9
},
"id": "CVE-2026-61555-e01a7280",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/academysoftwarefoundation/openexr/commit/6c6bc2d485f1435d3776b3b4a36f1617cf87070b",
"target": {
"file": "src/test/OpenEXRTest/testMultiView.cpp"
}
}
]
vanir_signatures_modified
"2026-10-28T11:11:59Z"