Log in Start free

Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-34588OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

High 8.8

In plain English

A high-severity out-of-bounds read in openexr from AcademySoftwareFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 56.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10openexr3.1.10-8.el10_1.2ALSA-2026:15888
AlmaLinux:10openexr3.1.10-8.el10_2.2ALSA-2026:19146
AlmaLinux:9openexr3.1.1-3.el9_7.2ALSA-2026:15887
AlmaLinux:9openexr3.1.1-3.el9_8.2ALSA-2026:19359
AlmaLinux:10openexr-devel3.1.10-8.el10_1.2ALSA-2026:15888
AlmaLinux:10openexr-devel3.1.10-8.el10_2.2ALSA-2026:19146
AlmaLinux:9openexr-devel3.1.1-3.el9_7.2ALSA-2026:15887
AlmaLinux:9openexr-devel3.1.1-3.el9_8.2ALSA-2026:19359
AlmaLinux:10openexr-libs3.1.10-8.el10_2.2ALSA-2026:19146
AlmaLinux:10openexr-libs3.1.10-8.el10_1.2ALSA-2026:15888
AlmaLinux:9openexr-libs3.1.1-3.el9_8.2ALSA-2026:19359
AlmaLinux:9openexr-libs3.1.1-3.el9_7.2ALSA-2026:15887
Alpine:v3.22openexr3.3.11-r0ALPINE-CVE-2026-34588
Alpine:v3.23openexr3.4.13-r0ALPINE-CVE-2026-34588
Alpine:v3.24openexr3.4.10-r0ALPINE-CVE-2026-34588
Debian:12openexrno fix listedDEBIAN-CVE-2026-34588
Debian:13openexrno fix listedDEBIAN-CVE-2026-34588
Debian:14openexr3.4.14-0.1DEBIAN-CVE-2026-34588
PyPIopenexr3.4.9GHSA-588r-cr5c-w6hf
PyPIopenexr3.2.7GHSA-588r-cr5c-w6hf
PyPIopenexr3.3.9GHSA-588r-cr5c-w6hf
PyPIopenexr3.2.7, 3.3.9, 3.4.9PYSEC-2026-2845
Rocky Linux:10openexr0:3.1.10-8.el10_2.2RLSA-2026:19146
Rocky Linux:10openexr0:3.1.10-8.el10_1.2RLSA-2026:15888
Rocky Linux:9openexr0:3.1.1-3.el9_7.2RLSA-2026:19359
Rocky Linux:9openexr0:3.1.1-3.el9_7.2RLSA-2026:15887
Ubuntu:25.10openexrno fix listedUBUNTU-CVE-2026-34588
Ubuntu:26.10openexrno fix listedUBUNTU-CVE-2026-34588

Affected products (as reported)

VendorProductVersions
AcademySoftwareFoundation openexr >= 3.1.0, <= 3.1.13>= 3.2.0, < 3.2.7>= 3.3.0, < 3.3.9>= 3.4.0, < 3.4.9

Weakness: CWE-125, CWE-190, CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References