Detections
Analytics

Echo: openexr: security update to 3.1.13-2+e2

high Tenable Self-Hosted Container Security Plugin ID 474349

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenEXR is the reference implementation and specification for the EXR image file format, widely used in
 the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13,
 the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::row() API when a
 deep image has a non-zero dataWindow origin. The row() accessor is documented as 0-based and computes its
 address from an internal base that is offset for absolute pixel coordinates, so the two coordinate models
 conflict whenever dataWindow.min is non-zero. For a deep image whose data window has a large negative
 vertical origin, row(0) points far outside the allocated sample-count buffer. An application that opens an
 attacker-controlled deep EXR file and accesses sample counts through row() performs an out-of-bounds read,
 which can crash the process or, under a controlled heap layout, return adjacent heap memory as sample-
 count values. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14. (CVE-2026-59981)

Solution

Update the openexr library and its related packages to version 3.1.13-2+e2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-59981

Plugin Details

Severity: High

ID: 474349

Version: Revision 1.1

Type: Local

Published: 10/11/2026

Updated: 10/11/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.52

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C

CVSS Score Source: CVE-2026-59981

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/27/2026

Vulnerability Publication Date: 8/14/2026

Reference Information

CVE: CVE-2026-59981