CVE-2026-68515
CVE-2026-68515: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.1
High [CVE-2026-68515] Heap out-of-bounds write in exrmultiview via crafted EXR files
CVE-2026-68515Source published Source updated
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied, individually valid scanline EXR files whose union dataWindow is not aligned to one view's channel subsampling. The utility allocates sampled channel storage using a truncated union_width / xSampling, then reads the sampled input through a Slice based on the misaligned union window, producing a heap out-of-bounds write. The trigger is normal public-tool processing, such as exrmultiview left A.exr right B.exr out.exr with crafted but valid inputs, so this is not solely an API or caller-precondition issue.…
- Affected products in this advisory
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 8
1 more entries in the full advisory.
- Source-reported affected versions
- < 3.2.11
- < 3.3.0
- < 3.3.12
- < 3.4.0
1 more entries in the full advisory.
- Source-reported fixed versions
- 3.2.11
- 3.3.13
- 3.4.14
- openexr-0:3.1.10-8.el10_2.4
3 more entries in the full advisory.
- Mitigation guidance
- To mitigate this issue, avoid processing untrusted or unverified EXR image files with the `exrmultiview` utility. Users should exercise caution when handling EXR files from unknown or suspicious sources. If possible, restrict the execution environment of `exrmultiview` through sandboxing mechanisms to limit potential impact.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.