LoginSign Up
← Back to all sparks
O

OpenEXR

DESIGN
Velocity5.0

High dynamic range image file format and library for visual effects

openexr.com ↗

A second IDManifest flaw lands two weeks after OpenEXR's forty-CVE sweep

image-formatmemory-safetyfuzzingvfxcve-batchmulti-branch
◆Current state
OpenEXR's recent history is dominated by security response. On 2026-08-05 three branches were tagged within two minutes — v3.4.14, v3.3.13 and v3.2.11, fixing 15, 15 and 10 CVEs from one fuzzing and audit campaign, all memory corruption reachable by opening a crafted .exr file. Two weeks later v3.4.15 and v3.3.14 fix two further memory-allocation issues, this time confined to the code that decodes the idmanifest attribute, with CVEs requested but not yet assigned. The 3.4 tag also carries a missing Windows export and reduced compiler warnings in example code.
◆Where it's heading
The pattern is now established: findings arrive from a continuing fuzzing effort and are patched simultaneously across every supported stream, with the release notes written to tell integrators precisely which code paths are reachable. The narrowing scope is the useful signal — August's first batch spanned the C++ libraries, the command-line tools and the Python bindings, while this one touches only idmanifest decoding and explicitly states other code is unaffected even on files carrying the attribute. Both new tags are release candidates dated ahead of their tagging, and the 3.3 backport reuses the 3.4 note verbatim, down to naming v3.4.15 in its own body.
◆Prediction
Expect the requested CVEs to be assigned identifiers and the two RCs to be promoted to final tags, with a matching 3.2 backport if the idmanifest code is present in that stream. Further attribute-parser findings are likely while the fuzzing campaign continues.

◆Recent moves

  1. 7h ago

    3.3.14 backports the IDManifest memory fixes to the 3.3 stream

    The 3.3-stream backport of the same two IDManifest memory-allocation fixes, tagged an hour after the 3.4 release and carrying its note verbatim — the body names v3.4.15 rather than its own version, and omits the Windows export and compiler-warning items specific to 3.4. Same multi-branch simultaneous-patch discipline as the 2026-08-05 sweep.

    View source ↗
  2. 8h ago

    3.4.15 fixes two IDManifest memory-allocation flaws

    Two memory issues in IDManifest parsing, where corrupt or malicious input could trigger excessive allocation; CVEs are requested but not yet assigned. Scope is deliberately bounded — only idmanifest decoding is affected, and the notes state other code is safe even on files carrying the attribute. Also fixes a missing Windows export and trims compiler warnings in the example code.

    View source ↗
  3. 14d ago

    3.4.14 fixes 15 CVEs found by fuzzing the .exr parser

    The largest of the three coordinated 2026-08-05 tags: 15 CVEs plus broader hardening from a single fuzzing and audit effort, spanning PyOpenEXR channel coalescing, 32-bit integer overflows, and the command-line tools. Establishes the response pattern the IDManifest fixes now follow.

    View source ↗
  4. 14d ago

    3.3.13 backports the same 15 CVE fixes to the 3.3 stream

    The 3.3-stream twin of v3.4.14, tagged in the same minute with the same 15 CVE fixes and near-identical notes. Backporting the full set rather than a subset is what makes the 3.3 line a viable target for integrators who cannot move to 3.4.

    View source ↗
  5. 14d ago

    3.2.11 carries 10 of the CVE fixes to the oldest supported stream

    The oldest supported stream received 10 of the CVE fixes, a smaller set than its siblings — consistent with 3.2 predating some of the affected code rather than being partially patched. Completes the three-branch simultaneous release.

    View source ↗
  6. 2mo ago

    3.3.12-rc updates CI install scripts

    A CI install-script update with a sign-off line as its entire body — build-infrastructure maintenance with no user-visible change. Notable only as the last tag before the security work began.

    View source ↗