CVE-2023-5841 is a critical (CVSS 9.1) heap buffer overflow in the OpenEXR image library, in version 3.2.1 and earlier. A crafted deep scanline file with a bad sample count triggers it. The fix shipped in OpenEXR 3.2.2 and 3.1.12, so upgrade and rebuild anything that bundles the library.
What's affected
- Product: OpenEXR from the Academy Software Foundation.
- Affected: version 3.2.1 and prior.
- Fixed: 3.2.2 on the 3.2 line and 3.1.12 on the 3.1 line, per the NVD record.
- Severity: 9.1 Critical in the NVD record (CWE-122 and CWE-787).
- Not confirmed: the Fedora announcements linked in the record could not be read during this review, so check your distribution for how it names the patched package.
How to check if you're exposed
OpenEXR is a library, so it is often present as a transitive dependency of image tools, 3D software, game engines and Python or Node packages. Start with the system package manager:
# Debian or Ubuntu
dpkg -l | grep -i openexr
# Fedora, RHEL
rpm -qa | grep -i openexr
# macOS with Homebrew
brew list --versions openexr
For application builds, search lockfiles and vendored folders for openexr. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can check a manifest or lockfile for known CVEs without installing anything. Note that distributions often backport fixes without changing the upstream version, so read your vendor's advisory when the version looks old.
What to do now
- Upgrade OpenEXR to 3.2.2 or later on the 3.2 line, or 3.1.12 or later on the 3.1 line.
- Rebuild and redeploy any application or container that statically links or bundles OpenEXR. A system package update will not reach those copies.
- Where you cannot update yet, stop processing EXR files from untrusted sources in services that run with high privilege.
- Run image conversion and thumbnail services in a sandbox or a low privilege container.
- Re-scan your dependencies after the update to confirm no old copy remains.
Why it matters
The record says the library does not check the number of scanline samples in a deep scanline file before using it. Deep images store a variable number of samples per pixel, so the sizes come from the file. A file that lies about a count can make the parser write past the end of a heap buffer. The weakness classes are CWE-122, heap based buffer overflow, and CWE-787, out-of-bounds write.
The exposure is where image files arrive from outside: upload features, asset pipelines, render farms and preview generators. The score is critical because a heap overflow in a parser can lead to code execution, though real impact depends on the application and the platform mitigations. The record does not list this CVE as known exploited. The biggest practical risk is the library hiding in a build you forgot about.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
I only use OpenEXR through another tool. Am I affected?
Possibly. If that tool bundles or links the vulnerable library, yes. Check the tool's own release notes or your SBOM for the OpenEXR version it carries.
Sources
Last reviewed: 19 October 2026.
