Buffer Overflow Vulnerability in OpenEXR Library Affecting Image Storage Formats
CVE-2026-27622

8.4HIGH

Key Information:

Vendor

Academysoftwarefoundation

Status
Openexr
Vendor
CVE Published:
3 March 2026

What is CVE-2026-27622?

The OpenEXR library, widely used for mastering images in the motion picture industry, has a buffer overflow vulnerability in the CompositeDeepScanLine::readPixels function. This flaw arises from improper handling of per-pixel total sizes, which allows an attacker to exploit the wrapping of unsigned integer sizes. As a result, this can lead to a buffer overrun when adjusting the size of sample buffers handled during decoding. This issue has been remedied in versions 3.2.6, 3.3.8, and 3.4.6, thus emphasizing the importance of updating to ensure secure handling of EXR image formats.

Affected Version(s)

openexr >= 2.3.0, < 3.2.6 < 2.3.0, 3.2.6

openexr >= 3.3.0, < 3.3.8 < 3.3.0, 3.3.8

openexr >= 3.4.0, < 3.4.6 < 3.4.0, 3.4.6

References

https://github.com/AcademySoftwareFoundation/openexr/secu...
x_refsource_CONFIRM

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.