An integer overflow vulnerability (CVE-2026-27622, CVSS 7.8 HIGH) in OpenEXR allows arbitrary code execution during EXR file processing. The affected versions are OpenEXR before 3.2.6, 3.3.0 through 3.3.7, and 3.4.0 through 3.4.5. Red Hat has issued an Important security update with patched packages for RHEL 8; the upstream fix requires upgrading to OpenEXR version 3.2.6, 3.3.8, or 3.4.6.
Red Hat Product Errata RHSA-2026:8863 - Security Advisory Issued: 2026-04-20 Updated: 2026-04-20 RHSA-2026:8863 - Security Advisory Overview Updated Packages Synopsis Important: OpenEXR security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for OpenEXR is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description OpenEXR is a high dynamic-range (HDR) image file format developed by Industrial Light & Magic for use in computer imaging applications. This package contains libraries and sample applications for handling the format. Security Fix(es): openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for x86_64 8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le Red Hat CodeReady Linux Builder for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2444251 - CVE-2026-27622 openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing CVEs CVE-2026-27622 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM OpenEXR-2.2.0-12.el8_10.1.src.rpm SHA-256: 4fcd60176e6b6d265a763b6d93595b15a8fa6446247c2f360df9b98415e88352 x86_64 OpenEXR-debuginfo-2.2.0-12.el8_10.1.i686.rpm SHA-256: e90030794dd1a4a74af2c26d76321d69a343c95ec1f56d0f5b6da4a707efc370 OpenEXR-debuginfo-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: c5d8625b9c3f603dcc2da977d75ddf3a0e2461f732430253987b74b06c3fdbfe OpenEXR-debugsource-2.2.0-12.el8_10.1.i686.rpm SHA-256: b9ad70391e74986e4627ac07396e41e302e5268ba1066f24f01c04229bda1c28 OpenEXR-debugsource-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: 844095398a89fcdf6a0003de10ba9c6e10bdedf0ecc0fb88d427d6e9d6f1a9fc OpenEXR-libs-2.2.0-12.el8_10.1.i686.rpm SHA-256: 05081173079e1a578e2f1e0478fb19d54f36dd384082bbfb1d6546eca735ba5b OpenEXR-libs-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: f359cc8de19e0a8680be8df051bb315ec211daa1a2782c238b71b95a79f226b2 OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.i686.rpm SHA-256: 8a33d2ef3338a3ce8ce9bcf8d749d4d691d7027cd25c5078863c37360167a3dd OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: 0937fb129678e6fde4b5d05fb733547d09550edf1bc2b493a97a68a3e6c12853 Red Hat Enterprise Linux for IBM z Systems 8 SRPM OpenEXR-2.2.0-12.el8_10.1.src.rpm SHA-256: 4fcd60176e6b6d265a763b6d93595b15a8fa6446247c2f360df9b98415e88352 s390x OpenEXR-debuginfo-2.2.0-12.el8_10.1.s390x.rpm SHA-256: d814e4ec503125484ea0cc16c3a535491c58ca3e8d4559251520ced13ae945d0 OpenEXR-debugsource-2.2.0-12.el8_10.1.s390x.rpm SHA-256: 21eb112da89acdbed1d8a4eaa45007fefd9e8519cfac7a44de06bab45f1137d0 OpenEXR-libs-2.2.0-12.el8_10.1.s390x.rpm SHA-256: adcfd00da7650273a7e52b1cdeff7f69cc11f68bd915dca15fb35677f4e8643e OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.s390x.rpm SHA-256: 03c1b896a6df235f6f7597387b0db0457f6e654f25f68c95375179d19f1c47f6 Red Hat Enterprise Linux for Power, little endian 8 SRPM OpenEXR-2.2.0-12.el8_10.1.src.rpm SHA-256: 4fcd60176e6b6d265a763b6d93595b15a8fa6446247c2f360df9b98415e88352 ppc64le OpenEXR-debuginfo-2.2.0-12.el8_10.1.ppc64le.rpm SHA-256: de432fb764bff8d26bec0dfde16a2ea4a4cb94a75b37bac88a1bdb9500df07c7 OpenEXR-debugsource-2.2.0-12.el8_10.1.ppc64le.rpm SHA-256: c405bb171b1f0ac4f2cf022283f60a5c6b8f7aab5f0f91e61ab824742e8579e1 OpenEXR-libs-2.2.0-12.el8_10.1.ppc64le.rpm SHA-256: d1a175c65acc637830fce9df7ba4a5dad5182b0eacb100bf48e6c06e89be58e9 OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.ppc64le.rpm SHA-256: 8846511f83c70418d7dc319f609f63bc3a263744543f5bb100595ad775c12486 Red Hat Enterprise Linux for ARM 64 8 SRPM OpenEXR-2.2.0-12.el8_10.1.src.rpm SHA-256: 4fcd60176e6b6d265a763b6d93595b15a8fa6446247c2f360df9b98415e88352 aarch64 OpenEXR-debuginfo-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: 6424244fa4c7887019d3598e3e86cfa258c1f62bb483b0bcbaeb8ad74c445df9 OpenEXR-debugsource-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: c081c4783573cdf85d6afe65f1f5d9035273ead0a47d6a568336b53cca8f3df1 OpenEXR-libs-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: 0ed56d5f490d23923cc5e5bec252635be3213e6a2cc821c10fc2c6e7040a8526 OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: a4e44f33e00b6334d16d0444f3bb9d330b8b066261376f1b87833211eda9cf46 Red Hat CodeReady Linux Builder for x86_64 8 SRPM x86_64 OpenEXR-debuginfo-2.2.0-12.el8_10.1.i686.rpm SHA-256: e90030794dd1a4a74af2c26d76321d69a343c95ec1f56d0f5b6da4a707efc370 OpenEXR-debuginfo-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: c5d8625b9c3f603dcc2da977d75ddf3a0e2461f732430253987b74b06c3fdbfe OpenEXR-debugsource-2.2.0-12.el8_10.1.i686.rpm SHA-256: b9ad70391e74986e4627ac07396e41e302e5268ba1066f24f01c04229bda1c28 OpenEXR-debugsource-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: 844095398a89fcdf6a0003de10ba9c6e10bdedf0ecc0fb88d427d6e9d6f1a9fc OpenEXR-devel-2.2.0-12.el8_10.1.i686.rpm SHA-256: 1c530500ccfbf3821bd16ce17ab46b0c09d6bf0090894d605de107b70b9d0101 OpenEXR-devel-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: df701eeff8144a2ea3d3d198d14223e5c17f294697213835ba253a3b0abfbd90 OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.i686.rpm SHA-256: 8a33d2ef3338a3ce8ce9bcf8d749d4d691d7027cd25c5078863c37360167a3dd OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: 0937fb129678e6fde4b5d05fb733547d09550edf1bc2b493a97a68a3e6c12853 Red Hat CodeReady Linux Builder for Power, little endian 8 SRPM ppc64le OpenEXR-debuginfo-2.2.0-12.el8_10.1.ppc64le.rpm SHA-256: de432fb764bff8d26bec0dfde16a2ea4a4cb94a75b37bac88a1bdb9500df07c7 OpenEXR-debugsource-2.2.0-12.el8_10.1.ppc64le.rpm SHA-256: c405bb171b1f0ac4f2cf022283f60a5c6b8f7aab5f0f91e61ab824742e8579e1 OpenEXR-devel-2.2.0-12.el8_10.1.ppc64le.rpm SHA-256: e3c3c4680d2e5e2d9579c71b152a5e02f441699cb50cfd863133c7bb5fb06921 OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.ppc64le.rpm SHA-256: 8846511f83c70418d7dc319f609f63bc3a263744543f5bb100595ad775c12486 Red Hat CodeReady Linux Builder for ARM 64 8 SRPM aarch64 OpenEXR-debuginfo-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: 6424244fa4c7887019d3598e3e86cfa258c1f62bb483b0bcbaeb8ad74c445df9 OpenEXR-debugsource-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: c081c4783573cdf85d6afe65f1f5d9035273ead0a47d6a568336b53cca8f3df1 OpenEXR-devel-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: 2b106500facd3ec8cbf410a75059c3c279e4b92fd4fcbb1b2bc7bc4a159776c9 OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: a4e44f33e00b6334d16d0444f3bb9d330b8b066261376f1b87833211eda9cf46 Red Hat CodeReady Linux Builder for IBM z Systems 8 SRPM s390x OpenEXR-debuginfo-2.2.0-12.el8_10.1.s390x.rpm SHA-256: d814e4ec503125484ea0cc16c3a535491c58ca3e8d4559251520ced13ae945d0 OpenEXR-debugsource-2.2.0-12.el8_10.1.s390x.rpm SHA-256: 21eb112da89acdbed1d8a4eaa45007fefd9e8519cfac7a44de06bab45f1137d0 OpenEXR-devel-2.2.0-12.el8_10.1.s390x.rpm SHA-256: 856b039b62662e5061a857cfbc89f511bde132d720af8982a8cb86f85d41a4d9 OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.s390x.rpm SHA-256: 03c1b896a6df235f6f7597387b0db0457f6e654f25f68c95375179d19f1c47f6 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM OpenEXR-2.2.0-12.el8_10.1.src.rpm SHA-256: 4fcd60176e6b6d265a763b6d93595b15a8fa6446247c2f360df9b98415e88352 x86_64 OpenEXR-debuginfo-2.2.0-12.el8_10.1.i686.rpm SHA-256: e90030794dd1a4a74af2c26d76321d69a343c95ec1f56d0f5b6da4a707efc370 OpenEXR-debuginfo-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: c5d8625b9c3f603dcc2da977d75ddf3a0e2461f732430253987b74b06c3fdbfe OpenEXR-debugsource-2.2.0-12.el8_10.1.i686.rpm SHA-256: b9ad70391e74986e4627ac07396e41e302e5268ba1066f24f01c04229bda1c28 OpenEXR-debugsource-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: 844095398a89fcdf6a0003de10ba9c6e10bdedf0ecc0fb88d427d6e9d6f1a9fc OpenEXR-libs-2.2.0-12.el8_10.1.i686.rpm SHA-256: 05081173079e1a578e2f1e0478fb19d54f36dd384082bbfb1d6546eca735ba5b OpenEXR-libs-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: f359cc8de19e0a8680be8df051bb315ec211daa1a2782c238b71b95a79f226b2 OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.i686.rpm SHA-256: 8a33d2ef3338a3ce8ce9bcf8d749d4d691d7027cd25c5078863c37360167a3dd OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.x86_64.rpm SHA-256: 0937fb129678e6fde4b5d05fb733547d09550edf1bc2b493a97a68a3e6c12853 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 SRPM OpenEXR-2.2.0-12.el8_10.1.src.rpm SHA-256: 4fcd60176e6b6d265a763b6d93595b15a8fa6446247c2f360df9b98415e88352 aarch64 OpenEXR-debuginfo-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: 6424244fa4c7887019d3598e3e86cfa258c1f62bb483b0bcbaeb8ad74c445df9 OpenEXR-debugsource-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: c081c4783573cdf85d6afe65f1f5d9035273ead0a47d6a568336b53cca8f3df1 OpenEXR-libs-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: 0ed56d5f490d23923cc5e5bec252635be3213e6a2cc821c10fc2c6e7040a8526 OpenEXR-libs-debuginfo-2.2.0-12.el8_10.1.aarch64.rpm SHA-256: a4e4