debian/tinyexr vulnerabilities

Latest debian/tinyexr CVEs

Newest publication first

1. CVE-2026-110597 Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory

   Published 2026-10-14

   Medium·CVSS 6.9

   Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadA...

2. CVE-2018-12687 tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.

   Published 2018-06-22

   High·CVSS 7.5

   tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.

3. CVE-2022-38529 tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.

   High·CVSS 7.8

   tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.

4. CVE-2022-34300 In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData.

   High·CVSS 8.8

   In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.