Out-of-Bounds Write Vulnerability in OpenEXR Image Storage by Academy Software Foundation
CVE-2026-34588

8.6HIGH

Key Information:

Vendor

Academysoftwarefoundation

Status
Openexr
Vendor
CVE Published:
6 April 2026

What is CVE-2026-34588?

The OpenEXR image storage format, utilized in the motion picture industry, contains a defect in the wavelet decoding process. The internal function 'internal_exr_undo_piz()' is vulnerable due to improper handling of signed 32-bit arithmetic. This issue allows for artfully constructed EXR files to cause an overflow, leading to incorrect memory addressing during decoding. The result is a significant risk of both out-of-bounds reads and writes, compromising data integrity. The vulnerability has been addressed in the updated versions 3.2.7, 3.3.9, and 3.4.9.

Affected Version(s)

openexr >= 3.1.0, <= 3.1.13 <= 3.1.0, 3.1.13

openexr >= 3.2.0, < 3.2.7 < 3.2.0, 3.2.7

openexr >= 3.3.0, < 3.3.9 < 3.3.0, 3.3.9

References

https://github.com/AcademySoftwareFoundation/openexr/secu...
x_refsource_CONFIRM

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.