CVE-2009-1720: Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial o...

Security readout for executives and security teams

OpenEXR 1.2.2 and 1.6.1 had integer overflow flaws that could make applications crash, and the CVE says code execution may be possible. Business risk is highest where user-supplied or third-party OpenEXR image files are processed automatically. Exposure is most likely in systems, applications, or OS packages using OpenEXR 1.2.2 or 1.6.1, especially image pipelines that process untrusted EXR files. The bundle lists vendor advisories from several distributions and Apple, but no complete affected-product inventory. Prioritize remediation for media-processing servers, render farms, creative workstations, or services accepting external image files. Lower urgency applies where OpenEXR is absent or only handles trusted local content. Mitigation focus: Inventory OpenEXR versions in hosts, containers, desktop software, and bundled dependencies.; Apply fixed OpenEXR packages from the relevant vendor advisory where available.; Limit or block untrusted EXR processing until affected OpenEXR versions are removed..

Prepared

Jun 28, 2026, 10:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.