PyPI/openexr CVE-2026-27622: high, EPSS 0.23%
OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write
Action: Upgrade openexr to 3.2.6 or later.
pip install openexr==3.2.6pip install openexr==3.3.8pip install openexr==3.4.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.3.0 | 3.2.6 | - |
| 3.3.0 | 3.3.8 | - |
| 3.4.0 | 3.4.6 | - |
Fixed versions
| 3.2.6 | 3.3.8 | 3.4.6 |
Sources
- osv: GHSA-cr4v-6jm6-4963
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963
- https://nvd.nist.gov/vuln/detail/CVE-2026-27622
- https://github.com/AcademySoftwareFoundation/openexr
CVE-2026-27622 · published · modified · JSON