Medium5.5Red Hat Linux

Medium [CVE-2026-61555] Denial of Service via crafted EXR image file

This medium-severity Red Hat Linux advisory covers CVE-2026-61555 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.

CVE-2026-61555 Published Aug 25, 2026Updated by vendor Aug 25, 2026

CVE-2026-61555

Affected products & platforms

Red Hat LinuxRed Hat Enterprise Linux

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing.

This occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

When processing a specially crafted EXR image file, an attacker could trigger an application crash. This occurs because the software attempts to access an empty list of image views when a specific header attribute is empty, leading to a Denial of Service (DoS) for the application.

Red Hat products ship OpenEXR versions that are affected by this vulnerability. Upstream has provided fixes only for the 3.2.x (3.2.11), 3.3.x (3.3.13), and 3.4.x (3.4.14) series.

Products shipping older branches (1.x, 2.x, 3.0.x, 3.1.x) remain vulnerable as no fixes are available for these versions. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.

Affected versions

< 3.2.11
< 3.3.0
< 3.3.12
< 3.4.0
< 3.4.13

Official advisory · high-confidence parse· fetched 26 minutes ago·verify at source

Fixed versions

3.2.11
3.3.13
3.4.14

Official advisory · high-confidence parse· fetched 26 minutes ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Avoid processing untrusted EXR image files from unknown sources. Validate and sanitize EXR files before processing. Consider upgrading to OpenEXR 3.2.11 or later if the deployment context allows.

Official advisory · high-confidence parse· fetched 26 minutes ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.