Information Disclosure Vulnerability in OpenEXR Image Format by Academy Software Foundation

CVE-2026-34543

What is CVE-2026-34543?

OpenEXR, the reference implementation for the EXR file format utilized in the motion picture industry, contains a vulnerability that exposes sensitive information from heap memory through its decoded pixel data. This issue affects versions 3.4.0 to 3.4.7 and can be triggered by simply opening a malicious EXR file, making it a significant risk under default operational settings. The vulnerability has been addressed in version 3.4.8, which users are strongly encouraged to upgrade to in order to mitigate potential data exposure.

References