Integer Overflow Vulnerability in OpenEXR Image Format Software by Academy Software Foundation
CVE-2026-40244
8.4HIGH
What is CVE-2026-40244?
The OpenEXR software, utilized for handling EXR file formats in the motion picture industry, suffers from an integer overflow vulnerability due to improper calculations in the internal_dwa_compressor.h file. Specifically, the height and width are multiplied using int32 arithmetic without a cast to (size_t), potentially leading to unexpected behavior. Versions prior to 3.4.10, 3.3.10, and 3.2.8 are affected. Users are advised to upgrade to mitigate risks associated with this oversight. Fixes addressing this issue can be found in the latest updates available.
Affected Version(s)
openexr >= 3.2.0, < 3.2.8 < 3.2.0, 3.2.8
openexr >= 3.3.0, < 3.3.10 < 3.3.0, 3.3.10
openexr >= 3.4.0, < 3.4.10 < 3.4.0, 3.4.10