# SBOM for openexr 3.4.7 > Python bindings for the OpenEXR image file format The Python package openexr 3.4.7 ships 12 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/openexr@3.4.7` - PyPI: https://pypi.org/project/openexr/3.4.7/ - Requires Python: \>=3.7 - Bug Tracker: - Homepage: - Source: ## SBOMs ### openexr-3.4.7-cp310-cp310-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/aad5d71b-3e35-5f01-a5bb-fb76cd93b7f4/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp310-cp310-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/b5ca0a45-934b-5db9-afa6-b742ce460f21/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp311-cp311-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/28ef0283-01ca-53b1-b082-b2e9b2780e72/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp311-cp311-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/a664b136-c4ee-5383-ad4c-6acc5e002139/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp312-cp312-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/bd07c3f8-04ea-53c8-904f-f56f38e19d12/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp312-cp312-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/37be7dfe-6dc4-5305-badf-7d5696d7a534/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp313-cp313-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/6c5f3ffd-65a0-5d10-b5c4-28ba76c3f7f9/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp313-cp313-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/1b327d64-4f9b-5a53-aebb-93609e23932e/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp38-cp38-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/27788178-741f-5b89-b3fa-ed430c90b7fe/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp38-cp38-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/f6ad1a25-9da0-5d2d-adfd-f51cddfd10a9/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp39-cp39-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/8ac8b47d-4d9c-54d3-8aed-0e18b715cb59/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### openexr-3.4.7-cp39-cp39-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, AcademySoftwareFoundation/openexr, workflow python-wheels-publish.yml). - [openexr-3.4.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/7336ce2b-5456-510e-9c4c-85e66eec32b8/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-34543](https://insights.sbomify.com/CVE-2026-34543/) | high (8.7) | openexr 3.4.7 (PyPI) | 3.4.8 | OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo\_pxr24\_impl) | | [CVE-2026-34588](https://insights.sbomify.com/CVE-2026-34588/) | high (8.6) | openexr 3.4.7 (PyPI) | 3.4.9 | OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write | | [CVE-2026-34544](https://insights.sbomify.com/CVE-2026-34544/) | high (8.4) | openexr 3.4.7 (PyPI) | 3.4.8 | OpenEXR: integer overflow to OOB write in uncompress\_b44\_impl() | | [CVE-2026-34589](https://insights.sbomify.com/CVE-2026-34589/) | high (8.4) | openexr 3.4.7 (PyPI) | 3.4.9 | OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/openexr@3.4.7 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/openexr/3.4.7.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/openexr/3.4.7