- CVE-2026-54920: validate the data window and pre-initialise every level pointer in OpenEXRUtil Image::resize(), so an overflowing level size no longer leaves clearLevels() deleting uninitialised ImageLevel pointers - CVE-2026-55059: map the row index with dataWindow.min.y instead of min.x in SampleCountChannel::set(int, unsigned int[]) and bounds-check the per-pixel setter, so a valid row no longer writes before the sample-count buffer - CVE-2026-55373: reject sample counts above 0x80000000 in roundListSizeUp(), so the unsigned shift loop can no longer wrap to zero and spin forever - CVE-2026-59183: widen the chunk width, height and row index to int64_t in unpack_sample_table(), so a large deep tile no longer overflows the sample-table index arithmetic and reads unmapped memory - CVE-2026-59184: index the TypedFlatImageChannel row() accessors from the compact _pixels array instead of the absolute-coordinate _base pointer, so writing rows of an image with a non-zero data window origin no longer writes outside the pixel buffer - CVE-2026-59186: validate Array/Array2D dimensions and compute the Array2D element count in 64-bit arithmetic, so an oversized tile no longer under-allocates the Rgba conversion buffer on ILP32 builds - CVE-2026-59189: index the TypedDeepImageChannel row() accessors from the compact _sampleListPointers array instead of the absolute-coordinate _base pointer, so reading rows of a deep image with a non-zero data window origin no longer reads outside the sample-list pointer buffer - CVE-2026-59981: index SampleCountChannel::row() from the compact _numSamples array instead of the absolute-coordinate _base pointer, so row(0) stays inside the allocation for a deep image with a non-zero data window origin - CVE-2026-59983: compute the deep sample-count table size in uint64_t and reject a truncating conversion in update_pack_unpack_ptrs(), so an ILP32 build no longer allocates a wrapped-to-zero table - CVE-2026-59984: reject a scratch-buffer size that does not survive the conversion to size_t in internal_exr_undo_b44() and internal_exr_undo_b44a(), so B44/B44A decode no longer writes past a truncated ILP32 allocation - CVE-2026-61555: return defaultViewName() instead of multiView[0] in viewFromChannelName(), so a crafted empty multiView attribute no longer indexes an empty vector