CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

graphics/openexr3.4.16

High dynamic-range (HDR) image file format

Maintainer
mandree@FreeBSD.org
Packages
openexr 3.4.16
Upstream
Higher version available: 3.5.2
CPE
openexr:openexr from the port
WWW
https://www.openexr.com/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (15)

VuXML entries whose affected range this version has left.

Commits (179)

Gleb Popov (arrowd) · 3.4.16
graphics/openexr*: update to 3.4.16 bugfix release

"v3.4.16 fixes a bug which created unreadable DWAB files in certain
circumstances.  There is also a fix to prevent 'undefined behavior'
warnings with the BytesAttribute"

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.16
PR:		299085
Pull request:	https://github.com/freebsd/freebsd-ports/pull/631
MFH:		2026Q4
d9d8def490
Po-Chuan Hsieh (sunpoet)
graphics/openjph: Update to 0.32.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases
728e27ab70
Po-Chuan Hsieh (sunpoet)
graphics/openjph: Update to 0.31.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases
0729b4b837
Gleb Popov (arrowd)
graphics/openexr*: security fix update to v3.4.15

"v3.4.15 fixes two memory issues when parsing IDManifests. Corrupt
or maliciously formed OpenEXR images could trigger excessive memory
allocation, but only in code which decodes the idmanifest attribute.
Other code is unaffected, even when handling files with idmanifest
attributes [...] CVEs have been requested for these issues."
<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.15>

CVEs are not yet communicated.

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/blob/v3.4.15/CHANGES.md#version-3415-august-21-2026

Pull request:	https://github.com/freebsd/freebsd-ports/pull/594
MFH:		2026Q3
PR:		297717
e51c07e1f8
Yusuf Yaman (nxjoseph)
graphics/openexr*: Security update 3.4.13 => 3.4.14

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14

PR:		297486
Reported by:	mandree (maintainer)
Approved by:	osa, vvd (Mentors, implicit)
Pull Request:	https://github.com/freebsd/freebsd-ports/pull/580
MFH:		2026Q3
Security:	CVE-2026-68514 PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow
Security:	CVE-2026-68513 PyOpenEXR prefixed literal RGB key collision heap buffer overflow
Security:	CVE-2026-62986 PyOpenEXR deep prefixed RGB stale lane disclosure
Security:	CVE-2026-61703 PyOpenEXR deep mixed RGB heap buffer overflow
Security:	CVE-2026-61555 empty multiView viewFromChannelName file crash
Security:	CVE-2026-59985 ILP32 OpenEXRCore RLE decode heap OOB read DoS
Security:	CVE-2026-59984 ILP32 B44 InputFile decode scratch buffer overflow
Security:	CVE-2026-59983 ILP32 DeepTiledInputFile sample count table decode OOB read
Security:	CVE-2026-59982 ILP32 DWAA InputFile packed AC buffer overflow
Security:	CVE-2026-59981 OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read
Security:	CVE-2026-59189 OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read
Security:	CVE-2026-59187 OpenEXR exrmetrics deep pixelmode heap buffer overflow
Security:	CVE-2026-59186 OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write
Security:	CVE-2026-59184 OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write
Security:	CVE-2026-59183 Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding
43e43009bb
Po-Chuan Hsieh (sunpoet)
graphics/openjph: Update to 0.30.1

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases
e5d2df7136
Gleb Popov (arrowd)
graphics/openexr*: security update to 3.4.13

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.13
MFH:		2026Q2
PR:		296159

Security:	CVE-2026-55373
OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts

Security:	CVE-2026-55371
OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length

Security:	CVE-2026-55059
OpenEXRUtil SampleCountChannel row setter heap out-of-bounds

Security:	CVE-2026-54920
Integer Overflow and Use of Uninitialized Pointer leading to Invalid Delete in OpenEXRUtil Image Resize

Security:	CVE-2026-53532
Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)

Pull Request:	https://github.com/freebsd/freebsd-ports/pull/543
4b576f06bb
Jochen Neumeister (joneum)
graphics/openexr*: update to 3.4.12

Changelog: https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.12

PR:	295508
Sponsored by:	Netzkommune GmbH
ef0ad05a44
Daniel Engberg (diizzy)
graphics/openexr*: Security update to 3.4.11

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.11

PR:		294882
Security:	787cde46-4424-11f1-943f-05b19d100dca
		CVE-2026-42217
		CVE-2026-42216
		CVE-2026-41142
MFH:		2026Q2
782fe1731d
Po-Chuan Hsieh (sunpoet)
graphics/openjph: Update to 0.27.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases
926bc32d6a
Daniel Engberg (diizzy)
graphics/openexr*: Security update to 3.4.10

Addresses security vulnerabilities

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.10

Obtained from:	GitHub repo
Security:	CVE-2026-39886
		CVE-2026-40244
		CVE-2026-40250
a096d170b8
Daniel Engberg (diizzy)
graphics/openexr*: Security update to 3.4.9

Addresses several security vulnerabilities

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.4.9/CHANGES.md#version-349-april--3-2026

PR:		294197
Security:       CVE-2026-34589, CVE-2026-34588, CVE-2026-34380,
		CVE-2026-34379, CVE-2026-34378,
		adb096d4-2e72-11f1-acc1-339a1a6999b0
ff3b84dc9b
Daniel Engberg (diizzy)
graphics/openexr*: Update to 3.4.8

Bugfix release

Changelog(s):
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.7
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.6

PR:		293859
d4d175a4cc
Daniel Engberg (diizzy)
graphics/openexr*: Security update to v3.4.5 and i386 fix

"Patch release that fixes an incorrect size check in
istream_nonparallel_read that could lead to a buffer overflow on invalid
input data."

Also fix i386 self-tests by adding -msse2: i386 builds require SSE2, but
the upstream cmake stuff does not enable this, so use CFLAGS_i386.

To prevent people seeing SIGILL crashes down late at run-time,
check if the CPU is sse2-capable by querying the clang compiler from
the pre-install script (pkg-plist's @preexec). Suggested by diizzy@.
  Other than that we could use the cpuid or the lscpu port instead, but
let's for now assume everything that wants to run OpenEXR also has a
working cc that is clang and has -march=native and gives us CPU details).
(GCC also gives us this but will use a different output format.)

While here, make failed tests verbose through ctest's environment so we
can see what's up from the build log already. (We need to go through
this indirection because our cmake.mk's :testing feature wants to go
through the test target instead of calling ctest directly.)

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.5
Security:	716d25a6-0fdc-11f1-bfdf-ff9355aecb00
MFH:		2026Q1
6b50d3885e
Po-Chuan Hsieh (sunpoet)
graphics/openjph: Update to 0.26.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases
d6c9802a4a
Matthias Andree (mandree)
graphics/openexr: fix build on Sandy Bridge CPUs

OpenEXR attempts to use F16C intrinsics when AVX available and
at least one of these is true: F16C available, GCC used, or clang used.

Intel Sandy Bridge processors do have AVX extensions,
but no F16C instruction set extension, so compilers (clang 19, 20, gcc 14)
complain:

work/openexr-3.4.4/src/lib/OpenEXRCore/unpack.c:37:18:
  error: always_inline function '_mm256_cvtph_ps' requires target feature 'f16c',
  but would be inlined into function 'half_to_float_buffer'
  that is compiled without support for 'f16c'
   37 |             out, _mm256_cvtph_ps (_mm_loadu_si128 ((const __m128i*) in)));
      |                  ^

Not bumping PORTREVISION because this is not a supported configuration.

https://github.com/AcademySoftwareFoundation/openexr/issues/2231

Reported by:	"UnitedMarsupials"
MFH:		2025Q4
90d4fc1621
Matthias Andree (mandree)
graphics/openexr*: update to 3.4.4

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.4
d947a5b3b6
Po-Chuan Hsieh (sunpoet)
graphics/openjph: Update to 0.25.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases
4d835e846e
Matthias Andree (mandree)
graphics/openexr*: security update to 3.4.3

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.3
Security:	c71a3914-ba96-11f0-aada-f59a8ea34d12
MFH:		2025Q4
2dc4c91ea5
Matthias Andree (mandree)
graphics/openexr: use official WITH_DEBUG=yes fix

We've developed an officially accepted solution with upstream and
upstream reporter of the issue that prompted the change that broke our
DEBUG builds, so let's switch to the official change to minimize
differences from upstream.

https://github.com/AcademySoftwareFoundation/openexr/issues/1981
https://github.com/AcademySoftwareFoundation/openexr/pull/2166/commits/efa3b861ab0ab515ec7923ce02500acf667eabb0

PR:		290615

Note I am not updating to v3.4.2 because it does not contain changes
for FreeBSD - it contains a fix for Windows, and the other Imath change
is unnecessary for us because our ports system handles the requisite.
c0f85663f3
Matthias Andree (mandree)
graphics/openexr: avoid _d suffix WITH_DEBUG

Apparently broken with upstream commit
https://github.com/AcademySoftwareFoundation/openexr/commit/848f84ae7504adcd89ec0da182499d5cd4e3b245

Might fix
PR:		290615
MFH:		2025Q4

No PORTREVISION bump because packaging fails if the issue strikes.
fc6615ea1d
Po-Chuan Hsieh (sunpoet)
graphics/openjph: Update to 0.24.1

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases
49b2153e79
Matthias Andree (mandree)
graphics/openexr*: update to v3.4.1

ChangeLog:	<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.1>
c2ae2ac8b0
Po-Chuan Hsieh (sunpoet)
graphics/openexr: Fix build with openjph 0.23.0+

- Add BUILD_DEPENDS check

Approved by:	portmgr (blanket)
Obtained from:	https://github.com/AcademySoftwareFoundation/openexr/pull/2122
3325dbe6f1
Matthias Andree (mandree)
graphics/openexr*: update to v3.4.0

Adds lossless compression with High Throughput JPEG-2000 (HTJ2K)
encoding, which adds an OpenJPH dependency.

The OneAPI TBB option isn't provided because it massively increases
self-test time on FreeBSD 14.3-amd64 and I don't see how production
use would be different.  This is with an AMD Ryzen processor.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.0
7231244c85
Matthias Andree (mandree)
*: Bump PORTREVISION for math/Imath update
566d74ed6b
Matthias Andree (mandree)
math/Imath: update to v3.2.0 bugfix release

ChangeLog: https://github.com/AcademySoftwareFoundation/Imath/releases/tag/v3.2.0

Note this changes the .so versioning again, so I'll again need to
do additional cleanups because people don't just depend on Imath.
This is unneeded extra work except in the situation of OpenEXR
which is co-developed with Imath by the upstream maintainer,
Academy Software Foundation (ASWF).

I have no intentions of MFH'ing this due to the .so versioning change.
a4bf931ee7
Matthias Andree (mandree)
graphics/openexr*: update to v3.3.5 bugfix release

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.5
MFH:		2025Q3 (after a few days)
5df7fe4fe3
Matthias Andree (mandree)
graphics/openexr*: Update to v3.3.4

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.4
MFH:		2025Q2
01fd7c5307
Matthias Andree (mandree)
graphics/openexr*: update to v3.3.3

This contains out-of-bounds memory access fixes, hence:

MFH:		2025Q1
ChangeLog: 	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3
81a38fb8f2
Matthias Andree (mandree)
graphics/openexr-website-docs: unbreak and update to 3.3.2

And while here, decouple our PORTVERSION from the openexr version so we
don't break builds.

v3.3.2 seems to have a regression and causes a warning around Latest
News inserts on one site, so add -DSPHINX_OPTS= to override the default
of -W which means "treat warnings as errors", as of 3.3.2, I see one
warning.
f3a38995f5
Matthias Andree (mandree)
graphics/openexr: Update to v3.3.2

We can now remove our patch to build the exrmetrics manpage.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.2
73e8df6a67
Matthias Andree (mandree) · 3.3.1
graphics/openexr*: upgrade to 3.3.1

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.1

Also add a local docs/CMakeLists.txt patch to add an exrmetrics man
page, omission reported upstream to
https://github.com/AcademySoftwareFoundation/openexr/issues/1881
e913756366
Matthias Andree (mandree) · 3.3.0
graphics/openexr*: upgrade to 3.3.0

This changes the ABI (but not the API) and .so file name,
so we will need to bump all PORTREVISIONs of users, and we'll also fix
graphics/ctl and multimedia/olive.

This is not going to be MFHd to 2024Q4 due to API change, and therefore
has also waited for 2024Q4 to branch before we committed this to main,
so as to avoid 2024Q4 breakage.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.0
PR:		281859
175bbab74c
Matthias Andree (mandree) · 3.2.4
graphics/openexr: Only build test suite when requested

In order to avoid ctest performance regressions, we also required
commit cbee39bcd1a2472b8f3e24754f5bb3a3429b79a0 from PR 278533.

PR:		278500
2ce9c15f88
Matthias Andree (mandree) · 3.2.4
graphics/openexr-website-docs: fix build with v3.2.4 changes

- share the distfiles directory and the NO_WRKSUBDIR
- update patch for updated upstream CMakeLists.txt infrastructure
b22709d5c5
Matthias Andree (mandree) · 3.2.4
graphics/openexr: update to bugfix release v3.2.4

ChangeLog: https://github.com/AcademySoftwareFoundation/openexr/blob/main/CHANGES.md#version-324-march-26-2024
ChangeLog: https://github.com/AcademySoftwareFoundation/openexr/blob/main/CHANGES.md#version-323-march-6-2024

Switch from auto-generated tarballs to those that use sigstore,
verify that -- see
https://github.com/AcademySoftwareFoundation/openexr/blob/main/SECURITY.md#signed-releases
and shuffle variables accordingly, including DISTFILES, EXTRACT_ONLY and NO_WRKSUBDIR updates.
5dde67a0a6
Matthias Andree (mandree) · 3.2.2_1
graphics/openexr: support non-root build in poudriere...

...by replacing CPIO with a MKDIR/CP combo.

Reported by:	arrowd@
ba2257cba9
Matthias Andree (mandree) · 3.2.2_1
graphics/openexr: fix post-extract to move testimages into place

...and avoid downloading in the configure phase.

Reported by:	Tatsuki Makino

While here, revert TESTING_UNSAFE, which does not reproduce,
neither under WITH_TESTING=yes in make.conf in poudriere after "make
distclean".

Bump PORTREVISION.
a967390ae7
Gleb Popov (arrowd) · 3.2.2
graphics/openexr: Mark TESTING_UNSAFE
92c5d523ae
Matthias Andree (mandree) · 3.2.2
graphics/openexr: security update to v3.2.2

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/blob/v3.2.2/CHANGES.md#version-322-february-11-2024

Security:	CVE-2023-5841
Security:	f161a5ad-c9bd-11ee-b7a7-353f1e043d9a
MFH:		2024Q1
7b057a3f4f
Matthias Andree (mandree) · 3.2.1
graphics/openexr: update to v3.2.1

ChangeLog: https://github.com/AcademySoftwareFoundation/openexr/blob/v3.2.1/CHANGES.md#version-321-september-27-2023

with one additional patch to change deflate_LIBRARIES to
deflate_LINK_LIBRARIES in the cmake stuff in order to unbreak
the build.

Reported upstream: https://github.com/AcademySoftwareFoundation/openexr/issues/1571

Upstream intended to release v3.2.2 on short notice, but the efforts
appear to have stalled, so ship 3.2.1 with our local fix.
9a529daeee
Matthias Andree (mandree) · 3.2.0
graphics/openexr: let openexr-website-docs use its own PORTNAME

I forgot to commit this change that was part of my test. Sorry.

Reported by:	antoine@
a72b285347
Matthias Andree (mandree) · 3.2.0
graphics/openexr: update to 3.2.0

- Also install manual pages (generated through help2man)
- The website (formerly known "DOCS" build) requires the "convert(1)"
  tool, which is part of ImageMagick, which itself depends on OpenEXR.
  To break the loop, split out the offline website build to a new
  package, graphics/openexr-website-docs
49fa9640ff
Matthias Andree (mandree) · 3.1.11
graphics/openexr: update to 3.1.11

Changelog: https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.11/CHANGES.md#version-3111-august-13-2023
MFH:       2023Q3
7936ba17c5
Matthias Andree (mandree) · 3.1.10_1
graphics/openexr: Fix some CPUTYPE builds.

Reported by:	jkim@FreeBSD.org
Obtained from:	https://github.com/AcademySoftwareFoundation/openexr/pull/1507
MFH:		2023Q3
db2c219ed3
Matthias Andree (mandree) · 3.1.10
graphics/openexr: bugfix update to 3.1.10

Changelog: 	https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.10/CHANGES.md#version-3110-august-2-2023

MFH:		2023Q3
fccca1f5f7
Matthias Andree (mandree) · 3.1.9
graphics/openexr: bugfix update → 3.1.9

https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.9/CHANGES.md#version-319-june-25-2023

Security:       06428d91-152e-11ee-8b14-dbdd62da85fb
d8e18f30d1
Matthias Andree (mandree) · 3.1.8
graphics/openexr: bugfix update to 3.1.8

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.8
e9a55ec75c
Matthias Andree (mandree) · 3.1.7_3
*: bump PORTREVISION of Imath users

...because math/Imath 3.1.9 reset the major version of
libImath to 29 from 31. See math/Imath 3.1.9 for details.
a5fbd2fa98