Hi,

The following vulnerabilities were published for openexr.

CVE-2026-40250[0]:
| OpenEXR provides the specification and reference implementation of
| the EXR file format, an image storage format for the motion picture
| industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and
| 3.2.0 through 3.2.7, `internal_dwa_compressor.h:1040` performs
| `chan->width * chan->bytes_per_element` in `int32` arithmetic
| without a `(size_t)` cast. This is the same overflow pattern fixed
| in other decoders by CVE-2026-34589/34588/34544, but this line was
| missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that
| addresses `internal_dwa_compressor.h:1040`.

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m5qw-23x2-6phj
https://github.com/AcademySoftwareFoundation/openexr/pull/2346
Fixed by: https://github.com/AcademySoftwareFoundation/openexr/commit/416fecf71241c097d52da5b219d36afd94800e69 (main)
Fixed by: https://github.com/AcademySoftwareFoundation/openexr/commit/42d394a7b761325a3df7c2d57f9dfd905629ca4f (v3.4.10-rc)
Fixed by: https://github.com/AcademySoftwareFoundation/openexr/commit/a41f0d19841469148aabf7e1e056fab9f1c3c4f0 (v3.2.8-rc)


CVE-2026-40244[1]:
| OpenEXR provides the specification and reference implementation of
| the EXR file format, an image storage format for the motion picture
| industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and
| 3.2.0 through 3.2.7, `internal_dwa_compressor.h:1722` performs
| `curc->width * curc->height` in `int32` arithmetic without a
| `(size_t)` cast. This is the same overflow pattern fixed in other
| locations by the recent CVE-2026-34589 batch, but this line was
| missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that
| addresses `internal_dwa_compressor.h:1722`.

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m5qw-23x2-6phj
https://github.com/AcademySoftwareFoundation/openexr/pull/2346
Fixed by: https://github.com/AcademySoftwareFoundation/openexr/commit/416fecf71241c097d52da5b219d36afd94800e69 (main)
Fixed by: https://github.com/AcademySoftwareFoundation/openexr/commit/42d394a7b761325a3df7c2d57f9dfd905629ca4f (v3.4.10-rc)
Fixed by: https://github.com/AcademySoftwareFoundation/openexr/commit/a41f0d19841469148aabf7e1e056fab9f1c3c4f0 (v3.2.8-rc)


CVE-2026-39886[2]:
| OpenEXR provides the specification and reference implementation of
| the EXR file format, an image storage format for the motion picture
| industry. Versions 3.4.0 through 3.4.9 have a signed integer
| overflow vulnerability in OpenEXR's HTJ2K (High-Throughput JPEG
| 2000) decompression path. The `ht_undo_impl()` function in
| `src/lib/OpenEXRCore/internal_ht.cpp` accumulates a bytes-per-line
| value (`bpl`) using a 32-bit signed integer with no overflow guard.
| A crafted EXR file with 16,385 FLOAT channels at the HTJ2K maximum
| width of 32,767 causes `bpl` to overflow `INT_MAX`, producing
| undefined behavior confirmed by UBSan. On an allocator-permissive
| host where the required ~64 GB allocation succeeds, the wrapped
| negative `bpl` value would subsequently be used as a per-scanline
| pointer advance, which would produce a heap out-of-bounds write. On
| a memory-constrained host, the allocation fails before
| `ht_undo_impl()` is entered. This is the second distinct integer
| overflow in `ht_undo_impl()`. CVE-2026-34545 addressed a different
| overflow in the same function — the `int16_t p` pixel-loop counter
| at line ~302 that overflows when iterating over channels whose
| `width` exceeds 32,767. The CVE-2026-34545 fix did not touch the
| `int bpl` accumulator at line 211, which is the subject of this
| advisory. The `bpl` accumulator was also not addressed by any of the
| 8 advisories in the 2026-04-05 v3.4.9 release batch. This finding is
| structurally identical to CVE-2026-34588 (PIZ `wcount*nx` overflow
| in `internal_piz.c`) and should be remediated with the same pattern.
| The CVE-2026-34588 fix did not touch `internal_ht.cpp`. Version
| 3.4.10 contains a remediation that addresses the vulnerability in
| `internal_ht.cpp`.

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-r3mr-mx8q-jcw5
https://github.com/AcademySoftwareFoundation/openexr/pull/2345
Fixed by: https://github.com/AcademySoftwareFoundation/openexr/commit/15fd269f7ecb291b0c4a31be695b5a2e6b566dc0 (main)
Fixed by: https://github.com/AcademySoftwareFoundation/openexr/commit/1577f226fb6644b7b63908af58c031bf3fd11649 (v3.4.10-rc)


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-40250
https://www.cve.org/CVERecord?id=CVE-2026-40250
[1] https://security-tracker.debian.org/tracker/CVE-2026-40244
https://www.cve.org/CVERecord?id=CVE-2026-40244
[2] https://security-tracker.debian.org/tracker/CVE-2026-39886
https://www.cve.org/CVERecord?id=CVE-2026-39886

Please adjust the affected versions in the BTS as needed.

Control: tags 1132578 + patch
Control: tags 1132578 + pending
Control: tags 1132579 + patch
Control: tags 1132579 + pending
Control: tags 1132580 + patch
Control: tags 1132580 + pending
Control: tags 1133188 + patch
Control: tags 1133188 + pending
Control: tags 1134642 + patch
Control: tags 1134642 + pending
Control: tags 1135946 + patch
Control: tags 1135946 + pending
Control: tags 1136001 + patch
Control: tags 1136001 + pending
Control: tags 1136879 + patch
Control: tags 1136879 + pending
Control: tags 1144763 + patch
Control: tags 1144763 + pending
Control: tags 1144878 + patch
Control: tags 1144878 + pending

Dear maintainer,

I've prepared an NMU for openexr (versioned as 3.4.14-0.1) and uploaded
it to DELAYED/2. Please feel free to tell me if I should cancel it.

cu
Adrian

Dear maintainer,

I've prepared an NMU for openexr (versioned as 3.4.14-0.1) and uploaded
it to DELAYED/1. Please feel free to tell me if I should cancel it.

Two changes compared to the previous version:
- list more CVEs in the changelog
- forwarded a patch upstream

cu
Adrian

We believe that the bug you reported is fixed in the latest version of
openexr, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1134642@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Adrian Bunk <bunk@debian.org> (supplier of updated openexr package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 20 Aug 2026 19:49:50 +0300
Source: openexr
Architecture: source
Version: 3.4.14-0.1
Distribution: unstable
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel@lists.alioth.debian.org>
Changed-By: Adrian Bunk <bunk@debian.org>
Closes: 1132578 1132579 1132580 1133188 1134642 1135946 1136001 1136879 1144763 1144878
Changes:
 openexr (3.4.14-0.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release. (Closes: #1136879)
     - Fixes FTBFS with glibc 2.43. (Closes: #1144878)
     - CVE-2026-34378: Signed integer overflow in generic_unpack()
     - CVE-2026-34379: Misaligned write in LossyDctDecoder_execute
     - CVE-2026-34380: Signed integer overflow in undo_pxr24_impl()
     - CVE-2026-34588: Signed 32-bit Overflow in PIZ Decoder
     - CVE-2026-34589: DWA Lossy Decoder Heap Out-of-Bounds Write
     (Closes: #1133188)
     - CVE-2026-34543: Heap information disclosure in PXR24 decompression
       (Closes: #1132580)
     - CVE-2026-34544: Integer overflow in uncompress_b44_impl()
       (Closes: #1132579)
     - CVE-2026-34545: Integer overflow in HTJ2K decoder
       (Closes: #1132578)
     - CVE-2026-39886: Signed Integer Overflow in ht_undo_impl()
     - CVE-2026-40244: Integer overflow in DWA setupChannelData
     - CVE-2026-40250: Integer overflow in DWA decoder
     (Closes: #1134642)
     - CVE-2026-41142: Integer overflow in ImageChannel::resize()
       (Closes: #1135946)
     - CVE-2026-42216: Out-of-bounds read in IDManifest::init()
     - CVE-2026-42217: Shift exponent overflow in readVariableLengthInteger()
     (Closes: #1136001)
     - CVE-2026-44663: Integer overflow in HTJ2K decoder
     - CVE-2026-45696: Heap buffer overflow in ht_undo_impl()
     - CVE-2026-59183: Signed Integer Overflow in Deep Tile Decoding
     - CVE-2026-59184: OpenEXRUtil FlatImageChannel row OOB write
     - CVE-2026-59186: OpenEXR ILP32 TiledRgbaInputFile large tile OOB write
     - CVE-2026-59187: OpenEXR exrmetrics deep pixelmode heap buffer overflow
     - CVE-2026-59189: OpenEXRUtil DeepImageChannel heap OOB read
     - CVE-2026-59981: OpenEXRUtil SampleCountChannel heap OOB read
     - CVE-2026-59982: ILP32 DWAA InputFile packed AC buffer overflow
     - CVE-2026-59983: ILP32 DeepTiledInputFile sample count table OOB read
     - CVE-2026-59984: ILP32 B44 InputFile decode scratch buffer overflow
     - CVE-2026-59985: ILP32 OpenEXRCore RLE decode heap OOB read DoS
     - CVE-2026-61555: Empty multiView viewFromChannelName file crash
   * Generate Provides that includes the Imath version and use in the shlibs.
     (Closes: #1144763)
   * Disable test that fails on armhf instead of ignoring all test failures
     on armhf.
   * Ignore test failures on all big endian architectures.
   * Attempt to fix FTBFS on hurd-amd64.
   * Ignore test failures on Hurd.
Checksums-Sha1:
 4e1228f642baa3d056345996075470e88150a253 2261 openexr_3.4.14-0.1.dsc
 c0bb14f1dfb0c9a6f2e38725397013ce9ce4d6b8 20598272 openexr_3.4.14.orig.tar.xz
 674d0668a9d7ed5619bb34670cab2513dbd573cd 19384 openexr_3.4.14-0.1.debian.tar.xz
Checksums-Sha256:
 30540eb3d46620be9aaed388d0c179d5846a890e94baf48e0f1650ca3cd4d7a7 2261 openexr_3.4.14-0.1.dsc
 5bc1a561a418ac59b5c309e42820dda0e6f4c087f10b5cf8e30c4899c1d68f09 20598272 openexr_3.4.14.orig.tar.xz
 d1f1929c2045562640f5c3cda3ef93ca49827e2ad91ae90fde243bd16a0aeeef 19384 openexr_3.4.14-0.1.debian.tar.xz
Files:
 9d9256429c816c2e26a22ad778d85ed9 2261 graphics optional openexr_3.4.14-0.1.dsc
 64216513dde4a579c60354b610bb4d6e 20598272 graphics optional openexr_3.4.14.orig.tar.xz
 e3937bbb7954bbf50ee6716787358e25 19384 graphics optional openexr_3.4.14-0.1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmqIN2YACgkQiNJCh6LY
mLF8Wg//dkxGb0fDrFTms4t1AGU/RCsBLVseTT/5Uj19NA2QmRW0YmKTWDqXZocR
RtuvI68uXEfaQkyiqPu2NGN7vrKls/uRJWmzTHUSVl8/ZteRX1cV8gV7mNcVS2m2
8y3/QStwtI01hic95HJLSzowvj+Jf8vlwp/zehkS7fluzbdgrDJJ1vlhGuo29toO
mVNdxXXPGbXzL7ZiP6VsZERwwFcXoI0Z5I/79DzWECuksASnAepAK6G58IXR9On5
JPEvXnbSVGkOLupvXUnb+rDXjOGQaYaBwZdK1by2NMjXTFOHEv7iiZPJ8WG9jegv
mfC5ckP2trlpl3i7kn4wU6cpVprXF9mqcWrpcpdsylEUouNugyKhaExILqxu9/Sh
vXH7kmz88OckgvAUzJsjk8A4mt+BcW5KTXjufHUYf6sS+lfHMOBAH9NZ/yikLR40
J+TNd/q49Wgfdy6l5OCgYB+1py/ub7H+R8r3UGhUlqPjgnrVbKengIpxE+gBUFJf
bZz1OOQpP5D6tkK02B9XEC9rS0eY+8RTt+BkML+r02IoPoanbILOPl8h4KhSptC6
g84K0C5bp5Od9/szAENqXaWaRWjd71y9oULX4n/SYlQkD4co2VhAya7fGxl8zb/Q
FavZbrG3lhwRPOfupiNstpSJwkBYdC0/+3GVkV93Oi753mtEElU=
=5zjm
-----END PGP SIGNATURE-----