{"id":"CLSA-2026-1792627161","summary":"openexr: Fix of 11 CVEs","details":"- CVE-2026-54920: validate the data window and pre-initialise every level\n  pointer in OpenEXRUtil Image::resize(), so an overflowing level size no\n  longer leaves clearLevels() deleting uninitialised ImageLevel pointers\n- CVE-2026-55059: map the row index with dataWindow.min.y instead of min.x in\n  SampleCountChannel::set(int, unsigned int[]) and bounds-check the per-pixel\n  setter, so a valid row no longer writes before the sample-count buffer\n- CVE-2026-55373: reject sample counts above 0x80000000 in roundListSizeUp(),\n  so the unsigned shift loop can no longer wrap to zero and spin forever\n- CVE-2026-59183: widen the chunk width, height and row index to int64_t in\n  unpack_sample_table(), so a large deep tile no longer overflows the\n  sample-table index arithmetic and reads unmapped memory\n- CVE-2026-59184: index the TypedFlatImageChannel row() accessors from the\n  compact _pixels array instead of the absolute-coordinate _base pointer, so\n  writing rows of an image with a non-zero data window origin no longer\n  writes outside the pixel buffer\n- CVE-2026-59186: validate Array/Array2D dimensions and compute the Array2D\n  element count in 64-bit arithmetic, so an oversized tile no longer\n  under-allocates the Rgba conversion buffer on ILP32 builds\n- CVE-2026-59189: index the TypedDeepImageChannel row() accessors from the\n  compact _sampleListPointers array instead of the absolute-coordinate _base\n  pointer, so reading rows of a deep image with a non-zero data window origin\n  no longer reads outside the sample-list pointer buffer\n- CVE-2026-59981: index SampleCountChannel::row() from the compact _numSamples\n  array instead of the absolute-coordinate _base pointer, so row(0) stays\n  inside the allocation for a deep image with a non-zero data window origin\n- CVE-2026-59983: compute the deep sample-count table size in uint64_t and\n  reject a truncating conversion in update_pack_unpack_ptrs(), so an ILP32\n  build no longer allocates a wrapped-to-zero table\n- CVE-2026-59984: reject a scratch-buffer size that does not survive the\n  conversion to size_t in internal_exr_undo_b44() and internal_exr_undo_b44a(),\n  so B44/B44A decode no longer writes past a truncated ILP32 allocation\n- CVE-2026-61555: return defaultViewName() instead of multiView[0] in\n  viewFromChannelName(), so a crafted empty multiView attribute no longer\n  indexes an empty vector","modified":"2026-10-26T09:31:01.320079102Z","published":"2026-10-21T23:59:41Z","upstream":["CVE-2026-54920","CVE-2026-55059","CVE-2026-55373","CVE-2026-59183","CVE-2026-59184","CVE-2026-59186","CVE-2026-59189","CVE-2026-59981","CVE-2026-59983","CVE-2026-59984","CVE-2026-61555"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792627161.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54920"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55059"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55373"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59183"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59184"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59186"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59189"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59981"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59983"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59984"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61555"}],"affected":[{"package":{"name":"openexr","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/openexr?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792627161.json"}},{"package":{"name":"openexr-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/openexr-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792627161.json"}},{"package":{"name":"openexr-libs","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/openexr-libs?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.el9.tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792627161.json"}}],"schema_version":"1.9.0"}