LoginSign Up
← Back to all sparks
O

OpenEXR

DESIGN
Velocity5.0

High dynamic range image file format and library for visual effects

openexr.com ↗

One fuzzing campaign, forty CVEs, and every supported OpenEXR branch patched at once

image-formatfuzzingmemory-safetyvfxcve-batchmulti-branch
◆Current state
OpenEXR's visible activity is a single coordinated security event: v3.4.14, v3.3.13 and v3.2.11 all tagged within two minutes of each other on 2026-08-05, fixing 15, 15 and 10 CVEs respectively from one fuzzing and audit effort. The vulnerability class is consistent — memory corruption, heap buffer overflows and out-of-bounds reads and writes — and the attack vector is a maliciously crafted .exr file opened through the C++ libraries, the command-line tools, or the PyOpenEXR bindings.
◆Where it's heading
This is an image-format library confronting the fact that it is a parser exposed to untrusted input across an entire industry's toolchain. Patching three release streams simultaneously rather than pushing everyone to the newest line is the tell: OpenEXR is embedded deep enough in production VFX pipelines that the maintainers cannot assume anyone can upgrade a minor version on demand.
◆Prediction
Expect the release candidates to promote to final tags with the same content, and further hardening patches as the fuzzing effort continues to produce findings beyond this batch.

◆Recent moves

  1. 5d ago

    3.4.14 fixes 15 CVEs found by fuzzing the .exr parser

    The current-line member of the coordinated security release: 15 CVEs plus broader hardening, nearly all memory corruption reachable by opening a crafted .exr file through the libraries, the exr command-line tools, or the Python bindings. The most consequential of the three, since it covers the branch new work sits on.

    View source ↗
  2. 5d ago

    3.3.13 backports the same 15 CVE fixes to the 3.3 stream

    Identical remediation scoped to the v3.3 release stream, tagged seconds apart from the 3.4 release. Its existence is the point — studios pinned to 3.3 get the same fixes without a minor-version migration.

    View source ↗
  3. 5d ago

    3.2.11 carries 10 of the CVE fixes to the oldest supported stream

    The 3.2 stream receives 10 of the CVEs rather than the full 15, reflecting which code paths exist on that branch. Completes a three-branch simultaneous patch of every supported line.

    View source ↗
  4. 1mo ago

    3.3.12-rc updates CI install scripts

    A CI-only change with a one-line body and no user-facing effect, tagged six weeks before the security batch. Build plumbing.

    View source ↗