BSD PortsOpenEXR -- several integer overflow vulnerabilities
· CVE-2026-39886, CVE-2026-40244, CVE-2026-40250 · VuXML entry
Cary Phillips reports: OpenEXR 3.4.10 is a patch release that addresses the following security vulnerabilities: CVE-2026-39886 HTJ2K Signed Integer Overflow in ht_undo_impl() CVE-2026-40244 Integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589) CVE-2026-40250 Integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)
Affected versions
- openexr < 3.4.10
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | graphics/openexr | 3.3.4 | vulnerable since 2026-04-19 | |
| OpenBSD | graphics/openexr | 3.5.2 | out of range, by version | |
| NetBSD | graphics/openexr | 3.4.15 | not listed | |
| MidnightBSD | graphics/openexr | 3.1.5 | in range, by version | |
| FreeBSD | graphics/openexr | 3.4.16 | fixed | (117 days after) |