CVE-2026-27622 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2026-27622 Interim 1 1 2026-03-05T00:15:06Z current 2026-03-05T00:15:06Z 2026-03-05T00:15:06Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2026-27622 OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server for SAP applications 16.0 openSUSE Leap 15.6 libIex-3_2-31 libIex-3_2-31-x86-64-v3 libIlmImf-2_2-23 libIlmImf-2_2-23-32bit libIlmImf-Imf_2_1-21 libIlmImfUtil-2_2-23 libIlmImfUtil-2_2-23-32bit libIlmThread-3_2-31 libIlmThread-3_2-31-x86-64-v3 libOpenEXR-3_2-31 libOpenEXR-3_2-31-x86-64-v3 libOpenEXRCore-3_2-31 libOpenEXRCore-3_2-31-x86-64-v3 libOpenEXRUtil-3_2-31 libOpenEXRUtil-3_2-31-x86-64-v3 openexr openexr-devel openexr-doc libIlmImf-2_2-23 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS openexr-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS openexr as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libIlmImf-2_2-23 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS openexr-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS openexr as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS libIlmImf-2_2-23 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 openexr-devel as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 openexr as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 libIlmImf-Imf_2_1-21 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS openexr as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libIlmImf-Imf_2_1-21 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS openexr as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libIlmImf-Imf_2_1-21 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS openexr as a component of SUSE Linux Enterprise Server 12 SP5-LTSS openexr-devel as a component of SUSE Linux Enterprise Server 12 SP5-LTSS openexr as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security libIlmImf-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS openexr-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS openexr as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libIlmImf-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS openexr-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS openexr as a component of SUSE Linux Enterprise Server 15 SP2-LTSS libIlmImf-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS openexr-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS openexr as a component of SUSE Linux Enterprise Server 15 SP3-LTSS libIlmImf-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS openexr-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS openexr as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libIlmImf-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP5-LTSS libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP5-LTSS openexr-devel as a component of SUSE Linux Enterprise Server 15 SP5-LTSS openexr as a component of SUSE Linux Enterprise Server 15 SP5-LTSS libIlmImf-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS openexr-devel as a component of SUSE Linux Enterprise Server 15 SP6-LTSS openexr as a component of SUSE Linux Enterprise Server 15 SP6-LTSS libIex-3_2-31 as a component of SUSE Linux Enterprise Server 16.0 libIex-3_2-31-x86-64-v3 as a component of SUSE Linux Enterprise Server 16.0 libIlmThread-3_2-31 as a component of SUSE Linux Enterprise Server 16.0 libIlmThread-3_2-31-x86-64-v3 as a component of SUSE Linux Enterprise Server 16.0 libOpenEXR-3_2-31 as a component of SUSE Linux Enterprise Server 16.0 libOpenEXR-3_2-31-x86-64-v3 as a component of SUSE Linux Enterprise Server 16.0 libOpenEXRCore-3_2-31 as a component of SUSE Linux Enterprise Server 16.0 libOpenEXRCore-3_2-31-x86-64-v3 as a component of SUSE Linux Enterprise Server 16.0 libOpenEXRUtil-3_2-31 as a component of SUSE Linux Enterprise Server 16.0 libOpenEXRUtil-3_2-31-x86-64-v3 as a component of SUSE Linux Enterprise Server 16.0 openexr as a component of SUSE Linux Enterprise Server 16.0 openexr-doc as a component of SUSE Linux Enterprise Server 16.0 openexr as a component of SUSE Linux Enterprise Server Teradata 12 SP3 openexr as a component of SUSE Linux Enterprise Server Teradata 15 SP4 libIlmImf-2_2-23 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 openexr-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 openexr as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libIlmImf-2_2-23 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 openexr-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 openexr as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 libIlmImf-2_2-23 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 libIlmImfUtil-2_2-23 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 openexr-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 openexr as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 libIex-3_2-31 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libIex-3_2-31-x86-64-v3 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libIlmThread-3_2-31 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libIlmThread-3_2-31-x86-64-v3 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libOpenEXR-3_2-31 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libOpenEXR-3_2-31-x86-64-v3 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libOpenEXRCore-3_2-31 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libOpenEXRCore-3_2-31-x86-64-v3 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libOpenEXRUtil-3_2-31 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libOpenEXRUtil-3_2-31-x86-64-v3 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 openexr as a component of SUSE Linux Enterprise Server for SAP applications 16.0 openexr-doc as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libIlmImf-2_2-23 as a component of openSUSE Leap 15.6 libIlmImf-2_2-23-32bit as a component of openSUSE Leap 15.6 libIlmImfUtil-2_2-23 as a component of openSUSE Leap 15.6 libIlmImfUtil-2_2-23-32bit as a component of openSUSE Leap 15.6 openexr as a component of openSUSE Leap 15.6 openexr-devel as a component of openSUSE Leap 15.6 openexr-doc as a component of openSUSE Leap 15.6 OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6. CVE-2026-27622 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libIlmImf-2_2-23 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libIlmImfUtil-2_2-23 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:openexr SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:openexr-devel SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libIlmImf-2_2-23 SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libIlmImfUtil-2_2-23 SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:openexr SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:openexr-devel SUSE Linux Enterprise Module for Desktop Applications 15 SP7:libIlmImf-2_2-23 SUSE Linux Enterprise Module for Desktop Applications 15 SP7:libIlmImfUtil-2_2-23 SUSE Linux Enterprise Module for Desktop Applications 15 SP7:openexr SUSE Linux Enterprise Module for Desktop Applications 15 SP7:openexr-devel SUSE Linux Enterprise Server 12 SP2-LTSS:libIlmImf-Imf_2_1-21 SUSE Linux Enterprise Server 12 SP2-LTSS:openexr SUSE Linux Enterprise Server 12 SP4-LTSS:libIlmImf-Imf_2_1-21 SUSE Linux Enterprise Server 12 SP4-LTSS:openexr SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:openexr SUSE Linux Enterprise Server 12 SP5-LTSS:libIlmImf-Imf_2_1-21 SUSE Linux Enterprise Server 12 SP5-LTSS:openexr SUSE Linux Enterprise Server 12 SP5-LTSS:openexr-devel SUSE Linux Enterprise Server 15 SP1-LTSS:libIlmImf-2_2-23 SUSE Linux Enterprise Server 15 SP1-LTSS:libIlmImfUtil-2_2-23 SUSE Linux Enterprise Server 15 SP1-LTSS:openexr SUSE Linux Enterprise Server 15 SP1-LTSS:openexr-devel SUSE Linux Enterprise Server 15 SP2-LTSS:libIlmImf-2_2-23 SUSE Linux Enterprise Server 15 SP2-LTSS:libIlmImfUtil-2_2-23 SUSE Linux Enterprise Server 15 SP2-LTSS:openexr SUSE Linux Enterprise Server 15 SP2-LTSS:openexr-devel SUSE Linux Enterprise Server 15 SP3-LTSS:libIlmImf-2_2-23 SUSE Linux Enterprise Server 15 SP3-LTSS:libIlmImfUtil-2_2-23 SUSE Linux Enterprise Server 15 SP3-LTSS:openexr SUSE Linux Enterprise Server 15 SP3-LTSS:openexr-devel SUSE Linux Enterprise Server 15 SP4-LTSS:libIlmImf-2_2-23 SUSE Linux Enterprise Server 15 SP4-LTSS:libIlmImfUtil-2_2-23 SUSE Linux Enterprise Server 15 SP4-LTSS:openexr SUSE Linux Enterprise Server 15 SP4-LTSS:openexr-devel SUSE Linux Enterprise Server 15 SP5-LTSS:libIlmImf-2_2-23 SUSE Linux Enterprise Server 15 SP5-LTSS:libIlmImfUtil-2_2-23 SUSE Linux Enterprise Server 15 SP5-LTSS:openexr SUSE Linux Enterprise Server 15 SP5-LTSS:openexr-devel SUSE Linux Enterprise Server 15 SP6-LTSS:libIlmImf-2_2-23 SUSE Linux Enterprise Server 15 SP6-LTSS:libIlmImfUtil-2_2-23 SUSE Linux Enterprise Server 15 SP6-LTSS:openexr SUSE Linux Enterprise Server 15 SP6-LTSS:openexr-devel SUSE Linux Enterprise Server Teradata 12 SP3:openexr SUSE Linux Enterprise Server Teradata 15 SP4:openexr SUSE Linux Enterprise Server for SAP Applications 15 SP4:libIlmImf-2_2-23 SUSE Linux Enterprise Server for SAP Applications 15 SP4:libIlmImfUtil-2_2-23 SUSE Linux Enterprise Server for SAP Applications 15 SP4:openexr SUSE Linux Enterprise Server for SAP Applications 15 SP4:openexr-devel SUSE Linux Enterprise Server for SAP Applications 15 SP5:libIlmImf-2_2-23 SUSE Linux Enterprise Server for SAP Applications 15 SP5:libIlmImfUtil-2_2-23 SUSE Linux Enterprise Server for SAP Applications 15 SP5:openexr SUSE Linux Enterprise Server for SAP Applications 15 SP5:openexr-devel SUSE Linux Enterprise Server for SAP Applications 15 SP6:libIlmImf-2_2-23 SUSE Linux Enterprise Server for SAP Applications 15 SP6:libIlmImfUtil-2_2-23 SUSE Linux Enterprise Server for SAP Applications 15 SP6:openexr SUSE Linux Enterprise Server for SAP Applications 15 SP6:openexr-devel openSUSE Leap 15.6:libIlmImf-2_2-23 openSUSE Leap 15.6:libIlmImf-2_2-23-32bit openSUSE Leap 15.6:libIlmImfUtil-2_2-23 openSUSE Leap 15.6:libIlmImfUtil-2_2-23-32bit openSUSE Leap 15.6:openexr openSUSE Leap 15.6:openexr-devel openSUSE Leap 15.6:openexr-doc important 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H