Log in Start free

Vulnerability · Published Mar 3, 2026 · Assigned by GitHub_M

CVE-2026-27622OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

High 7.4

In plain English

A high-severity out-of-bounds write in openexr from AcademySoftwareFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.2%top 84.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8OpenEXR-devel2.2.0-12.el8_10.1ALSA-2026:8863
AlmaLinux:8OpenEXR-libs2.2.0-12.el8_10.1ALSA-2026:8863
AlmaLinux:10openexr3.1.10-8.el10_1.1ALSA-2026:7682
AlmaLinux:9openexr3.1.1-3.el9_7.1ALSA-2026:8888
AlmaLinux:10openexr-devel3.1.10-8.el10_1.1ALSA-2026:7682
AlmaLinux:9openexr-devel3.1.1-3.el9_7.1ALSA-2026:8888
AlmaLinux:10openexr-libs3.1.10-8.el10_1.1ALSA-2026:7682
AlmaLinux:9openexr-libs3.1.1-3.el9_7.1ALSA-2026:8888
Debian:12openexrno fix listedDEBIAN-CVE-2026-27622
Debian:13openexrno fix listedDEBIAN-CVE-2026-27622
Debian:14openexr3.4.6+ds-1DEBIAN-CVE-2026-27622
PyPIopenexr3.2.6GHSA-cr4v-6jm6-4963
PyPIopenexr3.3.8GHSA-cr4v-6jm6-4963
PyPIopenexr3.4.6GHSA-cr4v-6jm6-4963
PyPIopenexr3.2.6, 3.3.8, 3.4.6PYSEC-2026-2846
Rocky Linux:8OpenEXR0:2.2.0-12.el8_10.1RLSA-2026:8863
Rocky Linux:10openexr0:3.1.10-8.el10_1.1RLSA-2026:7682
Rocky Linux:9openexr0:3.1.1-3.el9_7.1RLSA-2026:8888
Ubuntu:25.10openexrno fix listedUBUNTU-CVE-2026-27622

Affected products (as reported)

VendorProductVersions
AcademySoftwareFoundation openexr >= 2.3.0, < 3.2.6>= 3.3.0, < 3.3.8>= 3.4.0, < 3.4.6

Weakness: CWE-787, CWE-190 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References