OpenEXR 3.4.9__tar.gz → 3.4.10__tar.gz

{openexr-3.4.9 → openexr-3.4.10}/CHANGES.md

@@ -3,6 +3,7 @@
 
 # OpenEXR Release Notes
 
+* [Version 3.4.10](#version-3410-april-16-2026) April 16, 2026
 * [Version 3.4.9](#version-349-april--3-2026) April  3, 2026
 * [Version 3.4.8](#version-348-march-26-2026) March 26, 2026
 * [Version 3.4.7](#version-347-march-15-2026) March 15, 2026
@@ -13,6 +14,8 @@
 * [Version 3.4.2](#version-342-october-15-2025) October 15, 2025
 * [Version 3.4.1](#version-341-october-8-2025) October 8, 2025
 * [Version 3.4.0](#version-340-september-5-2025) September 5, 2025
+* [Version 3.3.9](#version-339-april--4-2026) April  4, 2026
+* [Version 3.3.8](#version-338-march-1-2026) March 1, 2026
 * [Version 3.3.7](#version-337-february-19-2026) February 19, 2026
 * [Version 3.3.6](#version-336-november-4-2025) November 5, 2025
 * [Version 3.3.5](#version-335-july-26-2025) July 26, 2025
@@ -21,6 +24,9 @@
 * [Version 3.3.2](#version-332-november-11-2024) November 11, 2024
 * [Version 3.3.1](#version-331-october-8-2024) October 8, 2024
 * [Version 3.3.0](#version-330-september-30-2024) September 30, 2024
+* [Version 3.2.7](#version-327-april-3-2026) April 3, 2026
+* [Version 3.2.6](#version-326-march-1-2026) March 1, 2026
+* [Version 3.2.5](#version-325-november-4-2025) November 4, 2025
 * [Version 3.2.4](#version-324-march-26-2024) March 26, 2024
 * [Version 3.2.3](#version-323-march-6-2024) March 6, 2024
 * [Version 3.2.2](#version-322-february-11-2024) February 11, 2024
@@ -92,6 +98,48 @@
 * [Version 1.0.1](#version-101)
 * [Version 1.0](#version-10)
 
+## Version 3.4.10 (April 16, 2026)
+
+Patch release that addresses the following security vulnerabilities:
+
+* [CVE-2026-39886](https://www.cve.org/CVERecord?id=CVE-2026-39886) HTJ2K Signed Integer Overflow in `ht_undo_impl()`
+* [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) Integer overflow in DWA `setupChannelData` `planarUncRle` pointer arithmetic (missed variant of CVE-2026-34589)
+* [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) Integer overflow in DWA decoder `outBufferEnd` pointer arithmetic (missed variant of CVE-2026-34589)
+
+### Merged Pull Requests
+
+* [2346](https://github.com/AcademySoftwareFoundation/openexr/pull/2346)
+Fix integer overflow in internal_dwa_compressor.h
+* [2345](https://github.com/AcademySoftwareFoundation/openexr/pull/2345)
+Fix HTJ2K bytes-per-line integer overflow in internal_ht.cpp
+* [2340](https://github.com/AcademySoftwareFoundation/openexr/pull/2340)
+Fix 3.4.9 cve list formatting
+* [2339](https://github.com/AcademySoftwareFoundation/openexr/pull/2339)
+fix link formatting typo
+* [2337](https://github.com/AcademySoftwareFoundation/openexr/pull/2337)
+notes and news for v3.4.9, v3.3.9, v3.2.7
+* [2334](https://github.com/AcademySoftwareFoundation/openexr/pull/2334)
+Add CVE-2026-34589,34588,34545,34544,34543,34380,34379,34378 to SECURITY.md
+* [2316](https://github.com/AcademySoftwareFoundation/openexr/pull/2316)
+Fix Pinned-Dependencies Scorecard alert in website workflow
+
+### Merged Workflow Pull Requests
+
+* [2360](https://github.com/AcademySoftwareFoundation/openexr/pull/2360)
+Bump actions/cache from 5.0.4 to 5.0.5
+* [2354](https://github.com/AcademySoftwareFoundation/openexr/pull/2354)
+Bump actions/upload-artifact from 7.0.0 to 7.0.1
+* [2343](https://github.com/AcademySoftwareFoundation/openexr/pull/2343)
+Bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0
+* [2341](https://github.com/AcademySoftwareFoundation/openexr/pull/2341)
+Bump jmertic/slack-release-notifier from 32206e01ee0b0f66865d2be13bb3c62e474b5ce0 to 9d7d3a84563d2ebc8f7b2271be6c9568fedd7f3a
+* [2338](https://github.com/AcademySoftwareFoundation/openexr/pull/2338)
+Fix CodeQL SARIF upload ref for pull_request workflows
+* [2336](https://github.com/AcademySoftwareFoundation/openexr/pull/2336)
+Bump pypa/cibuildwheel from 3.4.0 to 3.4.1
+* [2333](https://github.com/AcademySoftwareFoundation/openexr/pull/2333)
+Add CI test to validate "cmake --install .. --prefix <path>
+
 ## Version 3.4.9 (April  3, 2026)
 
 Patch release that addresses several security vulnerabilities.
@@ -160,6 +208,11 @@ This also eliminates several compiler warnings, particularly about the
 deprecated `isOptimizationEnabled()` API and deprecates standard
 attributes. 
 
+This version addresses the following security vulnerabilities:
+
+* [CVE-2026-34544](https://www.cve.org/CVERecord?id=CVE-2026-34544) integer overflow to OOB write in uncompress_b44_impl()
+* [CVE-2026-34543](https://www.cve.org/CVERecord?id=CVE-2026-34543) Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
+
 ### Merged Pull Requests
 
 * [2312](https://github.com/AcademySoftwareFoundation/openexr/pull/2312)
@@ -202,6 +255,11 @@ Patch release bug/build fixes:
 
 Full changelog: [v3.4.6..v3.4.7](https://github.com/AcademySoftwareFoundation/openexr/compare/v3.4.6..v3.4.7)
 
+This version addresses the following security vulnerabilities:
+
+* [CVE-2026-34545](https://www.cve.org/CVERecord?id=CVE-2026-34545)
+  integer overflow lead to OOB in HTJ2K decoder
+
 ### Merged Pull Requests
 
 * [2291](https://github.com/AcademySoftwareFoundation/openexr/pull/2291)
@@ -290,6 +348,10 @@ Tools:
 
 Also, this release bumps the vendered version of `libdeflate` to 1.25.
 
+This release addresses the following CVEs:
+* [CVE-2026-27622](https://www.cve.org/CVERecord?id=CVE-2026-27622)
+CompositeDeepScanLine integer-overflow leads to heap OOB write
+
 ### Merged Pull Requests:
 
 * [2274](https://github.com/AcademySoftwareFoundation/openexr/pulls/2274)
@@ -393,6 +455,10 @@ Patch release that fixes an incorrect size check in
 `istream_nonparallel_read` that could lead to a buffer overflow on
 invalid input data.
 
+This release addresses the following CVEs:
+* [CVE-2026-26981](https://www.cve.org/CVERecord?id=CVE-2026-26981)
+Heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
+
 ### Merged Pull Requests:
 
 * [2244](https://github.com/AcademySoftwareFoundation/pulls/2244)
@@ -482,6 +548,20 @@ Specifically:
 * Heap-based Buffer Overflow Remote Code Execution Vulnerability,
   reported by Trend Micro Zero Day Initiative.
 
+This release addresses the following CVEs:
+* [CVE-2025-64183](https://www.cve.org/CVERecord?id=CVE-2025-64183)
+Use after free in PyObject_StealAttrString
+* [CVE-2025-64182](https://www.cve.org/CVERecord?id=CVE-2025-64182)
+Buffer overflow in PyOpenEXR_old's channels() and channel()
+* [CVE-2025-64181](https://www.cve.org/CVERecord?id=CVE-2025-64181)
+Security Issue: Use of Uninitialized Memory in openexr
+* [CVE-2025-12840](https://www.cve.org/CVERecord?id=CVE-2025-12840)
+Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
+* [CVE-2025-12839](https://www.cve.org/CVERecord?id=CVE-2025-12839)
+Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
+* [CVE-2025-12495](https://www.cve.org/CVERecord?id=CVE-2025-12495)
+Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
+
 Also:
 
 * OSS-fuzz [456158449](https://issues.oss-fuzz.com/issues/456158449)
@@ -801,6 +881,120 @@ Fetch master branch of libdeflate on main
 * [1852](https://github.com/AcademySoftwareFoundation/openexr/pull/1852)
 Add an option to use TBB as the global provider
 
+## Version 3.3.9 (April  4, 2026)
+
+Patch release for v3.3 that addresses the following security vulnerabilities:
+
+* [CVE-2026-34589](https://www.cve.org/CVERecord?id=CVE-2026-34589) DWA Lossy Decoder Heap Out-of-Bounds Write
+* [CVE-2026-34588](https://www.cve.org/CVERecord?id=CVE-2026-34588) Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
+* [CVE-2026-34544](https://www.cve.org/CVERecord?id=CVE-2026-34544) integer overflow to OOB write in uncompress_b44_impl()
+* [CVE-2026-34543](https://www.cve.org/CVERecord?id=CVE-2026-34543) Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
+* [CVE-2026-34380](https://www.cve.org/CVERecord?id=CVE-2026-34380) Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression
+* [CVE-2026-34379](https://www.cve.org/CVERecord?id=CVE-2026-34379) Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)
+* [CVE-2026-34378](https://www.cve.org/CVERecord?id=CVE-2026-34378) Signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x
+
+### Merged Pull Requests
+
+* [2329](https://github.com/AcademySoftwareFoundation/openexr/pull/2329)
+Fix signed integer overflow in `LossyDctDecoder_execute()` pointer arithmatic
+* [2328](https://github.com/AcademySoftwareFoundation/openexr/pull/2328)
+fix integer overflow in PIZ wavelet buffer arithmetic
+* [2324](https://github.com/AcademySoftwareFoundation/openexr/pull/2324)
+Fix misaligned memory access in `LossyDctDecoder_execute` HALF→FLOAT expansion
+* [2323](https://github.com/AcademySoftwareFoundation/openexr/pull/2323)
+fix signed integer overflow in `undo_pxr24_impl()`
+* [2321](https://github.com/AcademySoftwareFoundation/openexr/pull/2321)
+Fix integer overflow in `srcbuffer` pointer arithmetic in `unpack_*`
+* [2312](https://github.com/AcademySoftwareFoundation/openexr/pull/2312)
+Fix B44/B44A integer overflow: use uint64_t for row offset
+* [2310](https://github.com/AcademySoftwareFoundation/openexr/pull/2310)
+PXR24: reject zlib output that does not match packed payload size
+
+## Version 3.3.8 (March 1, 2026)
+
+Patch release that prevents an integer overflow when using the
+`CompositeDeepScanLine` API to combine multiple deep parts.
+
+This release addresses the following CVEs:
+* [CVE-2026-27622](https://www.cve.org/CVERecord?id=CVE-2026-27622)
+CompositeDeepScanLine integer-overflow leads to heap OOB write
+
+### Merged Pull Requests:
+
+* [2256](https://github.com/AcademySoftwareFoundation/openexr/pull/2256)
+Report an error if a deep pixel as more than UINT_MAX samples
+
+## Version 3.3.7 (February 19, 2026)
+
+Patch release that fixes an incorrect size check in
+`istream_nonparallel_read` that could lead to a buffer overflow on
+invalid input data.
+
+This release addresses the following CVEs:
+* [CVE-2026-26981](https://www.cve.org/CVERecord?id=CVE-2026-26981)
+Heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
+
+
+### Merged Pull Requests:
+
+* [2244](https://github.com/AcademySoftwareFoundation/openexr/pull/2244)
+Fix incorrect size check in `istream_nonparallel_read`
+
+## Version 3.3.6 (November 4, 2025)
+
+Patch release that addresses several bugs, primarily involving
+properly rejecting corrupt input data.
+
+Specifically:
+
+* Buffer overflow in PyOpenEXR_old's `channels()` and `channel()` in
+  legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
+* Use after free in PyObject_StealAttrString in legacy python, reported
+  by Joshua Rogers (GitHub: MegaManSec).
+* Use of Uninitialized Memory in openexr, reported by Aldo Ristori
+  (GitHub: Kaldreic).
+* Heap-based Buffer Overflow Remote Code Execution Vulnerability,
+  reported by Trend Micro Zero Day Initiative.
+
+Other fixes:
+* Only populate `CMAKE_DEBUG_POSTFIX` with `_d` if it is undefined,
+  which makes it possible to set `CMAKE_DEBUG_POSTFIX=""`.
+
+This release addresses the following CVEs:
+* [CVE-2025-64183](https://www.cve.org/CVERecord?id=CVE-2025-64183)
+Use after free in PyObject_StealAttrString
+* [CVE-2025-64182](https://www.cve.org/CVERecord?id=CVE-2025-64182)
+Buffer overflow in PyOpenEXR_old's channels() and channel()
+* [CVE-2025-64181](https://www.cve.org/CVERecord?id=CVE-2025-64181)
+Security Issue: Use of Uninitialized Memory in openexr
+* [CVE-2025-12840](https://www.cve.org/CVERecord?id=CVE-2025-12840)
+Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
+* [CVE-2025-12839](https://www.cve.org/CVERecord?id=CVE-2025-12839)
+Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
+* [CVE-2025-12495](https://www.cve.org/CVERecord?id=CVE-2025-12495)
+Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
+
+### Merged Pull Requests:
+
+* [2168](https://github.com/AcademySoftwareFoundation/openexr/pull/2168)
+Fix improper use of `Py_DECREF` in legacy python module
+* [2166](https://github.com/AcademySoftwareFoundation/openexr/pull/2166)
+Only define CMAKE_DEBUG_POSTFIX if it is not already defined
+* [2164](https://github.com/AcademySoftwareFoundation/openexr/pull/2164)
+check storage_mode when computing chunk sizes
+* [2163](https://github.com/AcademySoftwareFoundation/openexr/pull/2163)
+Check for image size overflow in legacy python module
+* [2162](https://github.com/AcademySoftwareFoundation/openexr/pull/2162)
+verify packed/unpacked size with uncompressed data
+* [2161](https://github.com/AcademySoftwareFoundation/openexr/pull/2161)
+ImfCheckFile: handle partial deep tiles
+* [2160](https://github.com/AcademySoftwareFoundation/openexr/pull/2160)
+Fix issues with negative coordinates and sampling != 0
+* [2159](https://github.com/AcademySoftwareFoundation/openexr/pull/2159)
+Fix memset in exr_read_chunk when nread is negative
+* [2156](https://github.com/AcademySoftwareFoundation/openexr/pull/2156)
+Fix handling of corrupt RLE data
+
 ## Version 3.3.5 (July 26, 2025)
 
 Patch release with a couple bug/performance fixes:
@@ -1372,6 +1566,67 @@ Fix macOS arm64 build
 Propagate dwa core 3 1
 * [1418](https://github.com/AcademySoftwareFoundation/openexr/pull/1418)
 
+## Version 3.2.7 (April 3, 2026)
+
+Patch release for v3.2 that addresses the following security vulnerabilities:
+
+* [CVE-2026-34589](https://www.cve.org/CVERecord?id=CVE-2026-34589) DWA Lossy Decoder Heap Out-of-Bounds Write
+* [CVE-2026-34588](https://www.cve.org/CVERecord?id=CVE-2026-34588) Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
+* [CVE-2026-34544](https://www.cve.org/CVERecord?id=CVE-2026-34544) integer overflow to OOB write in uncompress_b44_impl()
+* [CVE-2026-34543](https://www.cve.org/CVERecord?id=CVE-2026-34543) Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
+* [CVE-2026-34380](https://www.cve.org/CVERecord?id=CVE-2026-34380) Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression
+* [CVE-2026-34379](https://www.cve.org/CVERecord?id=CVE-2026-34379) Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)
+
+### Merged Pull Requests
+
+* [2329](https://github.com/AcademySoftwareFoundation/openexr/pull/2329)
+Fix signed integer overflow in `LossyDctDecoder_execute()` pointer arithmatic
+* [2328](https://github.com/AcademySoftwareFoundation/openexr/pull/2328)
+fix integer overflow in PIZ wavelet buffer arithmetic
+* [2324](https://github.com/AcademySoftwareFoundation/openexr/pull/2324)
+Fix misaligned memory access in `LossyDctDecoder_execute` HALF→FLOAT expansion
+* [2323](https://github.com/AcademySoftwareFoundation/openexr/pull/2323)
+fix signed integer overflow in `undo_pxr24_impl()`
+* [2312](https://github.com/AcademySoftwareFoundation/openexr/pull/2312)
+Fix B44/B44A integer overflow: use uint64_t for row offset
+* [2310](https://github.com/AcademySoftwareFoundation/openexr/pull/2310)
+PXR24: reject zlib output that does not match packed payload size
+
+## Version 3.2.6 (March 1, 2026)
+
+Patch release that prevents an integer overflow when using the
+`CompositeDeepScanLine` API to combine multiple deep parts.
+
+This release addresses the following CVEs:
+* [CVE-2026-27622](https://www.cve.org/CVERecord?id=CVE-2026-27622)
+CompositeDeepScanLine integer-overflow leads to heap OOB write
+
+### Merged Pull Requests:
+
+* [2256](https://github.com/AcademySoftwareFoundation/openexr/pull/2256)
+
+## Version 3.2.5 (November 4, 2025)
+
+Patch release that addresses bugs in the python module's legacy API.
+
+- Buffer overflow in PyOpenEXR_old's `channels()` and `channel()` in
+  legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
+- Use after free in PyObject_StealAttrString in legacy python, reported
+  by Joshua Rogers (GitHub: MegaManSec).
+
+This release addresses the following CVEs:
+* [CVE-2025-64182](https://www.cve.org/CVERecord?id=CVE-2025-64182)
+Buffer overflow in PyOpenEXR_old's channels() and channel()
+* [CVE-2025-64183](https://www.cve.org/CVERecord?id=CVE-2025-64183)
+Use after free in PyObject_StealAttrString
+
+### Merged Pull Requests:
+
+* [2168](https://github.com/AcademySoftwareFoundation/openexr/pull/2168)
+ Fix improper use of `Py_DECREF` in legacy python module
+* [2163](https://github.com/AcademySoftwareFoundation/openexr/pull/2163)
+Check for image size overflow in legacy python module
+
 ## Version 3.2.4 (March 26, 2024)
 
 Patch release that fixes handling of dwa compression in OpenEXRCore library.

{openexr-3.4.9 → openexr-3.4.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: OpenEXR
-Version: 3.4.9
+Version: 3.4.10
 Summary: Python bindings for the OpenEXR image file format
 Author-Email: Contributors to the OpenEXR project <info@openexr.com>
 Project-URL: Homepage, https://openexr.com

openexr-3.4.10/SECURITY.md

@@ -0,0 +1,230 @@
+<!-- SPDX-License-Identifier: BSD-3-Clause -->
+<!-- Copyright (c) Contributors to the OpenEXR Project -->
+
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you think you've found a potential vulnerability in OpenEXR, please
+report it by filing a GitHub [security
+advisory](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/new). Alternatively,
+email security@openexr.com and provide your contact info for further
+private/secure discussion.  If your email does not receive a prompt
+acknowledgement, your address may be blocked.
+
+Our policy is to acknowledge the receipt of vulnerability reports
+within 48 hours. Our policy is to address critical security vulnerabilities
+rapidly and post patches within 14 days if possible.
+
+## Known Vulnerabilities
+
+| CVE | Affected Versions | Patched Versions |
+| --- | ----------------- | ---------------- |
+| [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) | 3.2.0–3.2.7, 3.3.0–3.3.9, 3.4.0–3.4.9 | 3.2.8, 3.3.10, 3.4.10 |
+| [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) | 3.2.0–3.2.7, 3.3.0–3.3.9, 3.4.0–3.4.9 | 3.2.8, 3.3.10, 3.4.10 |
+| [CVE-2026-39886](https://www.cve.org/CVERecord?id=CVE-2026-39886) | 3.4.0–3.4.8 | 3.4.10 |
+| [CVE-2026-34589](https://www.cve.org/CVERecord?id=CVE-2026-34589) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.8 | 3.2.7, 3.3.9, 3.4.9 |
+| [CVE-2026-34588](https://www.cve.org/CVERecord?id=CVE-2026-34588) | 3.1.x, 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.8 | 3.2.7, 3.3.9, 3.4.9 |
+| [CVE-2026-34545](https://www.cve.org/CVERecord?id=CVE-2026-34545) | 3.4.0–3.4.6 | 3.4.7 |
+| [CVE-2026-34544](https://www.cve.org/CVERecord?id=CVE-2026-34544) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.7 | 3.2.7, 3.3.9, 3.4.8 |
+| [CVE-2026-34543](https://www.cve.org/CVERecord?id=CVE-2026-34543) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.7 | 3.2.7, 3.3.9, 3.4.8 |
+| [CVE-2026-34380](https://www.cve.org/CVERecord?id=CVE-2026-34380) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.8 | 3.2.7, 3.3.9, 3.4.9 |
+| [CVE-2026-34379](https://www.cve.org/CVERecord?id=CVE-2026-34379) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.8 | 3.2.7, 3.3.9, 3.4.9 |
+| [CVE-2026-34378](https://www.cve.org/CVERecord?id=CVE-2026-34378) | 3.4.0–3.4.8 | 3.4.9 |
+| [CVE-2026-27622](https://www.cve.org/CVERecord?id=CVE-2026-27622) | 2.x, 3.0.x, 3.1.x, 3.2.0–3.2.5, 3.3.0–3.3.7, 3.4.0–3.4.5 | 3.2.6, 3.3.8, 3.4.6 |
+| [CVE-2026-26981](https://www.cve.org/CVERecord?id=CVE-2026-26981) | 3.3.0–3.3.6, 3.4.0–3.4.4 | 3.3.7, 3.4.5 |
+| [CVE-2025-64183](https://www.cve.org/CVERecord?id=CVE-2025-64183) | 3.2.0–3.2.4, 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.2.5, 3.3.6, 3.4.3 |
+| [CVE-2025-64182](https://www.cve.org/CVERecord?id=CVE-2025-64182) | 3.2.0–3.2.4, 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.2.5, 3.3.6, 3.4.3 |
+| [CVE-2025-64181](https://www.cve.org/CVERecord?id=CVE-2025-64181) | 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.3.6, 3.4.3 |
+| [CVE-2025-48074](https://www.cve.org/CVERecord?id=CVE-2025-48074) | 3.3.2 | 3.3.3 |
+| [CVE-2025-48073](https://www.cve.org/CVERecord?id=CVE-2025-48073) | 3.3.2 | 3.3.3 |
+| [CVE-2025-48072](https://www.cve.org/CVERecord?id=CVE-2025-48072) | 3.3.2 | 3.3.3 |
+| [CVE-2025-48071](https://www.cve.org/CVERecord?id=CVE-2025-48071) | 3.3.0–3.3.2 | 3.3.3 |
+| [CVE-2025-12840](https://www.cve.org/CVERecord?id=CVE-2025-12840) | 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.3.6, 3.4.3 |
+| [CVE-2025-12839](https://www.cve.org/CVERecord?id=CVE-2025-12839) | 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.3.6, 3.4.3 |
+| [CVE-2025-12495](https://www.cve.org/CVERecord?id=CVE-2025-12495) | 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.3.6, 3.4.3 |
+| [CVE-2023-5841](https://nvd.nist.gov/vuln/detail/CVE-2023-5841) | 3.1.0–3.1.11, 3.2.0–3.2.1 | 3.2.2 |
+| [CVE-2021-45942](https://nvd.nist.gov/vuln/detail/CVE-2021-45942) | 3.1.0–3.1.3 | 3.1.4 |
+| [CVE-2021-20296](https://nvd.nist.gov/vuln/detail/CVE-2021-20296) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 |
+| [CVE-2021-3479](https://nvd.nist.gov/vuln/detail/CVE-2021-3479) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 |
+| [CVE-2021-3478](https://nvd.nist.gov/vuln/detail/CVE-2021-3478) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 |
+| [CVE-2021-3477](https://nvd.nist.gov/vuln/detail/CVE-2021-3477) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 |
+| [CVE-2021-3476](https://nvd.nist.gov/vuln/detail/CVE-2021-3476) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 |
+| [CVE-2021-3475](https://nvd.nist.gov/vuln/detail/CVE-2021-3475) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 |
+| [CVE-2021-3474](https://nvd.nist.gov/vuln/detail/CVE-2021-3474) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 |
+| [CVE-2020-16589](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16589) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0 | 2.4.0 |
+| [CVE-2020-16588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16588) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0 | 2.4.0 |
+| [CVE-2020-16587](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16587) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0 | 2.4.0 |
+| [CVE-2020-15306](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15306) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0–2.4.1, 2.5.0–2.5.1 | 2.5.2 |
+| [CVE-2020-15305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15305) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0–2.4.1, 2.5.0–2.5.1 | 2.5.2 |
+| [CVE-2020-15304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15304) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0–2.4.1, 2.5.0–2.5.1 | 2.5.2 |
+| [CVE-2020-11765](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11765) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 |
+| [CVE-2020-11764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11764) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 |
+| [CVE-2020-11763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11763) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 |
+| [CVE-2020-11762](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11762) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 |
+| [CVE-2020-11761](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11761) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 |
+| [CVE-2020-11760](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11760) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 |
+| [CVE-2020-11759](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11759) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 |
+| [CVE-2020-11758](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11758) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 |
+| [CVE-2018-18444](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18444) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0 | 2.4.0 |
+| [CVE-2018-18443](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18443) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0 | 2.4.0 |
+| [CVE-2017-9116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9116) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 |
+| [CVE-2017-9115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9115) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 |
+| [CVE-2017-9114](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9114) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 |
+| [CVE-2017-9113](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9113) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 |
+| [CVE-2017-9112](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9112) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 |
+| [CVE-2017-9111](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9111) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 |
+| [CVE-2017-9110](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9110) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 |
+| [CVE-2017-12596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12596) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1 | 2.3.0 |
+| [CVE-2009-1722](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1722) | 1.0.x, 1.1.x, 1.2.x, 1.3.x, 1.4.x, 1.5.x, 1.6.x | 1.7.0 |
+| [CVE-2009-1721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1721) | 1.0.x, 1.1.x, 1.2.x, 1.3.x, 1.4.x, 1.5.x, 1.6.x | 1.7.0 |
+| [CVE-2009-1720](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1720) | 1.0.x, 1.1.x, 1.2.x, 1.3.x, 1.4.x, 1.5.x, 1.6.x | 1.7.0 |
+
+See the [release notes](CHANGES.md) for more information.
+
+## Supported Versions
+
+This gives guidance about which releases/branches are supported with bug fixes and patches to
+security vulnerabilities.
+
+| Version / branch  | Supported                                            |
+|-------| ---------------------------------------------------- |
+| main  | :white_check_mark: :construction: All fixes immediately, although this branch is under development with potential unstable ABI/API
+| 3.4.x | :white_check_mark: All fixes that can be backported without breaking ABI compatibility
+| 3.3.x | :white_check_mark: All fixes that can be backported without breaking ABI compatibility
+| 3.2.x | :warning: Patch releases considered in response to specific requests
+| 3.1.x | :warning: Patch releases considered in response to specific requests
+| 3.0.x | :warning: Patch releases considered in response to specific requests
+| 2.5.x | :warning: Patch releases considered in response to specific requests
+| 2.4.x | :warning: Patch releases considered in response to specific requests
+| 2.3.x | :x: No longer receiving patches of any kind
+| 2.2.x | :x: No longer receiving patches of any kind
+| 2.1.x | :x: No longer receiving patches of any kind
+| 2.0.x | :x: No longer receiving patches of any kind
+| 1.x   | :x: No longer receiving patches of any kind
+
+## Signed Releases
+
+Releases artifacts are signed via
+[sigstore](https://www.sigstore.dev). See
+[release-sign.yml](.github/workflows/release-sign.yml) for details.
+
+To verify a downloaded release at a given tag:
+
+    % pip install sigstore
+    % sigstore verify github --cert-identity https://github.com/AcademySoftwareFoundation/openexr/.github/workflows/release-sign.yml@refs/tags/<tag> openexr-<tag>.tar.gz
+
+## Security Expectations
+
+### Software Features
+
+- The OpenEXR project implements the EXR image file format, used
+  throughout the motion picture industry and beyond, on Linux, macOS,
+  and Windows.
+
+- The project consists of a software run-time library, implemented in
+  C/C++ and built via cmake, that reads and writes image data
+  files. The project also distributes python wrappings for the C/C++
+  I/O API.
+
+- The library reads and writes binary image data and text-based
+  metadata, treated as blind data, none of which is executable code.
+
+- Other than the website and online technical documentation, the
+  project implements no web/online services or network communication
+  protocols.  The library never requests any security or
+  authentication credentials or login information from users.
+
+  The website implements no interactive features and requires no login
+  credentials.
+
+- The library reads and writes only to file paths specifically requested
+  via the C/C++ API. The runtime library uses no system configuration
+  files or sidecar data files. Access to data files uses only standard
+  file I/O system calls.
+
+- The library compresses/decompresses data via standard compression
+  algorithms but uses no cryptographic or confidentiality protocols.
+
+### Software Dependencies
+
+OpenEXR depends on
+[Imath](https://github.com/AcademySoftwareFoundation/Imath), a library
+of basic math operations also maintained and distributed by the
+OpenEXR project. Imath follows the same security conventions
+documented here for OpenEXR itself. The core Imath library has no
+external dependencies. The Imath python bindings depend on python and
+boost.
+
+The only
+external library dependency of OpenEXR is
+[libdeflate](https://github.com/ebiggers/libdeflate), which implements
+standard deflate/zlib/gzip compression and decompression.
+
+The project uses
+[Snyk](https://github.com/AcademySoftwareFoundation/openexr/blob/main/.github/workflows/snyk-scan-pr.yml)
+to scan for dependency vulnerability.
+
+### Potential Vulnerabilities
+
+Potential entry points are images being loaded using the
+library. Malformed images could caused issues such as heap buffer
+overflows, out-of-memory faults, or segmentation faults that could be
+exploitable as denial-of-service attacks.
+
+### Image Size Limits and Out-of-Memory Failures
+
+The OpenEXR file format places no fixed limit on image size, except
+that image width and height are represented by signed 32-bit integers
+and therefore technically limited to a maximum of 2,147,483,647.
+
+Memory allocation failures caused by large image dimensions declared
+in file headers are not considered security vulnerabilities when the
+allocation size is proportional to the declared image dimensions. EXR
+files can legitimately describe very large images, and the memory
+required to decode them is inherently proportional to their pixel
+count. Exhausting available memory on a given machine is a system
+resource constraint, not a library defect — the same file that
+triggers an out-of-memory error on one machine may load successfully
+on another with more memory.
+
+The OpenEXR library provides 
+`Imf::Header::setMaxImageSize(int maxWidth,int maxHeight)` and
+`Imf::Header:"setMaxTileSize(int maxWidth,int maxHeight)` (and
+`exr_set_default_maximum_image_size()` and
+`exr_set_default_maximum_tile_size()` in OpenEXRCore) to allow
+applications to reject files with dimensions exceeding a configurable
+limit before any large allocation occurs. Applications processing
+untrusted EXR files should set these limits to values appropriate for
+their deployment environment.
+
+### Hardening
+
+#### Testing
+
+The OpenEXR project implements a comprehensive suite of validation
+tests, including fuzz testing to harden against malicious input
+data. Note that fuzz testing hardens only against *small* input data
+files and is not a comprehensive test against all potential input.
+
+Note that the
+[exrcheck](https://github.com/AcademySoftwareFoundation/openexr/tree/main/src/bin/exrcheck)
+utility is intended to be used by testers to demonstrate a particular
+proof-of-concept input file exposes a vulnerability, and it is very
+helpful to let us know if a vulnerability can be reproduced using that
+tool.
+
+The project also uses the [OSS
+Fuzz](https://bugs.chromium.org/p/oss-fuzz) service for continuous
+fuzz testing.
+
+#### Development Cycle and Distribution
+
+OpenEXR is downloadable and buildable by C/C++ source via GitHub. Only
+members of the project's Technical Steering Committee, all veteran
+software engineers at major motion picture studios or vendors, have
+write permissions on the source code repository. All critical software
+changes are reviewed by multiple TSC members.
+
+The library is distributed in binary form via many common package
+managers across all platforms.

{openexr-3.4.9 → openexr-3.4.10}/src/lib/OpenEXRCore/internal_dwa_compressor.h

@@ -1037,7 +1037,8 @@ DwaCompressor_uncompress (
             if (rv != EXR_ERR_SUCCESS) return rv;
 
             cd->_dctData._type = chan->data_type;
-            outBufferEnd += chan->width * chan->bytes_per_element;
+            outBufferEnd +=
+                (size_t) chan->width * (size_t) chan->bytes_per_element;
         }
     }
 
@@ -1718,8 +1719,8 @@ DwaCompressor_setupChannelData (DwaCompressor* me)
         {
             for (int byte = 1; byte < curc->bytes_per_element; ++byte)
             {
-                cd->planarUncRle[byte] =
-                    cd->planarUncRle[byte - 1] + curc->width * curc->height;
+                cd->planarUncRle[byte] = cd->planarUncRle[byte - 1] +
+                    (size_t) curc->width * (size_t) curc->height;
 
                 cd->planarUncRleEnd[byte] = cd->planarUncRle[byte];
             }

{openexr-3.4.9 → openexr-3.4.10}/src/lib/OpenEXRCore/internal_ht.cpp

@@ -208,8 +208,8 @@ ht_undo_impl (
         || decode->channel_count != siz.get_num_components())
         return EXR_ERR_CORRUPT_CHUNK;
 
-    int  bpl       = 0;
-    bool is_planar = false;
+    int64_t bpl     = 0;
+    bool is_planar  = false;
     for (int16_t c = 0; c < decode->channel_count; c++)
     {
         bpl +=
@@ -218,6 +218,8 @@ ht_undo_impl (
             decode->channels[c].y_samples > 1)
         { is_planar = true; }
     }
+    if (bpl > INT32_MAX || bpl * decode->chunk.height > (int64_t) PTRDIFF_MAX)
+        return EXR_ERR_CORRUPT_CHUNK;
     cs.set_planar (is_planar);
 
     cs.create ();
@@ -368,7 +370,7 @@ ht_apply_impl (exr_encode_pipeline_t* encode)
 
     bool isPlanar = false;
     siz.set_num_components (encode->channel_count);
-    int bpl = 0;
+    int64_t bpl = 0;
     for (int16_t c = 0; c < encode->channel_count; c++)
     {
         int file_c = cs_to_file_ch[c].file_index;
@@ -391,7 +393,8 @@ ht_apply_impl (exr_encode_pipeline_t* encode)
         bpl += encode->channels[file_c].bytes_per_element *
                encode->channels[file_c].width;
     }
-
+    if (bpl > INT32_MAX || bpl * encode->chunk.height > (int64_t) PTRDIFF_MAX)
+        return EXR_ERR_CORRUPT_CHUNK;
     cs.set_planar (isPlanar);
 
     siz.set_image_offset (ojph::point (0, 0));

{openexr-3.4.9 → openexr-3.4.10}/src/lib/OpenEXRCore/openexr_version.h

@@ -10,6 +10,6 @@
 
 #    define OPENEXR_VERSION_MAJOR 3
 #    define OPENEXR_VERSION_MINOR 4
-#    define OPENEXR_VERSION_PATCH 9
+#    define OPENEXR_VERSION_PATCH 10
 
 #endif

openexr-3.4.10/website/latest_news_title.rst

@@ -0,0 +1,4 @@
+..
+  SPDX-License-Identifier: BSD-3-Clause
+  Copyright (c) Contributors to the OpenEXR Project.
+.. |latest-news-title| replace:: **April  3, 2026 - OpenEXR 3.4.9 Released**