All Versions
80
Latest Version
Avg Release Cycle
30 days
Latest Release
15 days ago

Changelog History
Page 2

  • v3.4.2 Changes

    October 16, 2025

    🚀 Patch release that fixes a Windows build issue introduced in v3.4.1.

    🏗 This version also bumps the auto-fetched Imath version to v3.2.2, which resolves a build problem with newer versions of cmake, involving duplicate library aliases.

    No change in functionality.

  • v3.4.1 Changes

    October 08, 2025

    🚀 Patch release that fixes a build issue: OpenJPH headers are now
    included from the openjph folder, as required by OpenJPH 0.23+.

    No change in functionality.

  • v3.4.0 Changes

    September 05, 2025

    OpenEXR v3.4 introduces a new, additional compression option to the OpenEXR file format for lossless compression with High Throughput JPEG-2000 (HTJ2K) encoding:

    • A new HTJ2K compressor uses the High-Throughput (HT) block coder. It supports the full range of OpenEXR features, including 16-bit and 32-bit floating-point image channels, both scanline and tiled.

    • 🆓 The HT block coder is standardized in Rec. ITU-T T.814 and ISO/IEC 15444-15. It is royalty-free , widely used in cinema and distribution servicing, and implemented in both commercial and open-source toolkits.

    • ✅ In experiments, we've found that HTJ2K produces smaller files, and depending on the nature of the image data, is one of the fastest compression types available in OpenEXR.

    • 🏗 Integration with OpenEXR uses the OpenJPH open-source library. For ease in managing the dependency, the OpenEXR CMake configuration supports automatically fetching and building OpenJPH internally , or linking against an external installation.

    • 👍 OpenEXR supports two new compression types with distinct space/time trade-offs:

    • All existing OpenEXR compression options remain unchanged. This new feature simply extends the range of compression types available.

    • ⚡️ Software compiled with OpenEXR v3.4 will be able to read HTJ2K compressed OpenEXRs without any code changes. Software that writes files may automatically support the new type, but may need a small update to make the new type available as a user option.

    • ⚠️ This is a backwards-compatible extension to the OpenEXR file format. Files written with OpenEXR v3.4 will be readable by applications built against previous releases, unless they use the new htj2k32 or htj2k256 compression options.

    • ⚠️ This feature was first introduced for evaluation in February, 2025 via the htj2k-beta branch with a single 256 scanlines/chunk compression option, with the 32-scanline option added more recently. Application software written during this evaluation period will need to change IMF_HTJ2K_COMPRESSION to IMF_HTJ2K256_COMPRESSION , although files written with the earlier evaluation version should still read properly.

    Other New Features:

    • 🆕 ✨ New colorInteropID standard attribute

    • 🆕 ✨ New bytes attribute type

    • 🔧 TBB as a global thread provider

    • 🔧 Vendored libdeflate

    🐛 Bug fixes:

    • 🐛 Using openexr via cmake add_subdirectory now works properly.

    🔄 Changes to the OpenEXR Python module:

    • 🐍 🐛 The Python module now allows an empty part name for a single-part file
    • 🐍 🐛 The header_only option for Python module's OpenEXR.File now works properly.
    • ➕ 🐍 📦 ⚠️ pypi distributions now add support for Python 3.13 and drop support for Python 3.7.

  • v3.3.11 Changes

    April 29, 2026

    🚀 Patch release for 3.3 that addresses the following security vulnerabilities:

    • CVE-2026-42217 Shift exponent overflow in readVariableLengthInteger() (ImfIDManifest.cpp)

    • CVE-2026-42216 Out-of-bounds read in IDManifest::init() during prefix expansion

    • CVE-2026-41142 Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API

    • OSS-fuzz 504280155 Heap-buffer-overflow in DwaCompressor_uncompress

  • v3.3.10 Changes

    April 17, 2026

    🚀 Patch release that addresses the following security vulnerabilities:

  • v3.3.9 Changes

    April 03, 2026

    🚀 Patch release for v3.3 that addresses the following security vulnerabilities:

    • CVE-2026-34589 DWA Lossy Decoder Heap Out-of-Bounds Write
    • CVE-2026-34588 Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
    • CVE-2026-34544 integer overflow to OOB write in uncompress_b44_impl()
    • CVE-2026-34543 Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
    • CVE-2026-34380 Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression
    • CVE-2026-34379 Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)
    • 📜 CVE-2026-34378 Signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x

  • v3.3.8 Changes

    March 01, 2026

    🚀 Patch release that prevents an integer overflow when using the CompositeDeepScanLine API to combine multiple deep parts.

  • v3.3.7 Changes

    February 20, 2026

    🚀 Patch release that fixes an incorrect size check in
    istream_nonparallel_read that could lead to a buffer overflow on
    invalid input data.

  • v3.3.6 Changes

    November 05, 2025

    🚀 Patch release that addresses several bugs, primarily involving properly rejecting corrupt input data.

    Specifically:

    • Buffer overflow in PyOpenEXR_old's channels() and channel() in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
    • 👉 Use after free in PyObject_StealAttrString in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
    • 👉 Use of Uninitialized Memory in openexr, reported by Aldo Ristori (GitHub: Kaldreic).
    • Heap-based Buffer Overflow Remote Code Execution Vulnerability, reported by Trend Micro Zero Day Initiative.

    Full changelog: v3.3.5..v3.3.6

  • v3.3.5 Changes

    July 26, 2025

    🚀 Patch release with a couple bug/performance fixes:

    • 🐛 Fix for DeepScanlineInputFile read memory leak
    • 🚀 OpenEXRCore Deep pixel unpacking optimisation