Read the docs
TI-2026-26666 Aliases CVE-2026-34380

Integer overflow in AcademySoftwareFoundation openexr

Priority MEDIUM 60CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a signed integer overflow exists in undo_pxr24_impl() in src/lib/OpenEXRCore/internal_pxr24.c at line 377. The expression (uint64_t)(w * 3) computes w * 3 as a signed 32-bit integer before casting to uint64_t. When w is large, this multiplication constitutes undefined behavior under the C standard. On tested builds (clang/gcc without sanitizers), two's-complement wraparound commonly occurs, and for specific values of w the wrapped result is a small positive integer, which may allow the subsequent bounds check to pass incorrectly. If the check is bypassed, the decoding loop proceeds to write pixel data through dout, potentially extending far beyond the allocated output buffer. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial openexr (AcademySoftwareFoundation): 3.2.7, 3.3.9, 3.4.9Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AcademySoftwareFoundationopenexr3.2.0 to before 3.2.7; 3.3.0 to before 3.3.9; 3.4.0 to before 3.4.93.2.7, 3.3.9, 3.4.9Patch availableCNA
  • openexr VendorAcademySoftwareFoundation Affected 3.2.0 to before 3.2.7; 3.3.0 to before 3.3.9; 3.4.0 to before 3.4.9 Fixed in 3.2.7, 3.3.9, 3.4.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*3.2.0 to before 3.2.7; 3.3.0 to before 3.3.9; 3.4.0 to before 3.4.9VulnerableAcademy Software Foundation
  • cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:* Versions 3.2.0 to before 3.2.7; 3.3.0 to before 3.3.9; 3.4.0 to before 3.4.9 Vulnerable ·Academy Software Foundation

Remediation

  • Fix · CNA openexr (AcademySoftwareFoundation) Fixed in 3.2.7, 3.3.9, 3.4.9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34380

References

Exploit 1

Other 3

  • TI-2026-30739 OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser CVSS 4.0HIGH 8.4
  • TI-2026-38605 OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) CVSS 4.0HIGH 7.1
  • TI-2026-48281 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union CVSS 3.1HIGH 7.1
  • TI-2026-48279 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision CVSS 3.1HIGH 7.1
  • TI-2026-42768 OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow CVSS 3.1HIGH 7.1
  • TI-2026-42338 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin CVSS 3.1HIGH 7.1
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences