Linuxsecurity Critical Denial of Service Vulnerabilities in Fedora's MinGW OpenEXR Library
Article Content
- •Two critical CVEs identified in Fedora's MinGW OpenEXR library.
- •CVE-2026-26981 allows denial of service via heap-buffer overflow.
- •CVE-2026-27622 enables arbitrary code execution through integer overflow.
Fedora has released updates for the MinGW Windows OpenEXR library due to significant vulnerabilities. Two critical CVEs have been identified: CVE-2026-26981, published on 2026-02-24, which allows for denial of service via a heap-buffer overflow when parsing malformed EXR files, and CVE-2026-27622, published on 2026-03-03, which enables arbitrary code execution through integer overflow in EXR file processing. The updates are available for versions 3.3.8 and 3.4.6. Users are advised to upgrade their systems using the 'dnf' update program to mitigate these risks. The vulnerabilities affect all Fedora systems utilizing the MinGW OpenEXR library. The potential impact includes service disruptions and unauthorized code execution. Current status indicates that patches are available, but users must act promptly to secure their systems.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-26981 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…