Detections
Analytics
SCA: security update for OpenEXR (GHSA-cr4v-6jm6-4963)
high Tenable Self-Hosted Container Security Plugin ID 438253
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- OpenEXR provides the specification and reference implementation of the EXR file format, an image storage
format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are
accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts,
total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in
samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample
counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized
composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6. (CVE-2026-27622)
See Also
Plugin Details
Severity: High
ID: 438253
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 3/4/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.88
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-27622
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 7
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.4
Threat Score: 7
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/2/2026
Vulnerability Publication Date: 3/2/2026
Reference Information
CVE: CVE-2026-27622
cwe: CWE-787