Log in Start free

Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-34589OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write

High 8.8

In plain English

A high-severity integer overflow in openexr from AcademySoftwareFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 62.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, the DWA lossy decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. For a large enough width, the calculation overflows and later decoder stores operate on a wrapped pointer outside the allocated rowBlock backing store. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22openexr3.3.11-r0ALPINE-CVE-2026-34589
Alpine:v3.23openexr3.4.13-r0ALPINE-CVE-2026-34589
Alpine:v3.24openexr3.4.10-r0ALPINE-CVE-2026-34589
Debian:12openexrno fix listedDEBIAN-CVE-2026-34589
Debian:13openexrno fix listedDEBIAN-CVE-2026-34589
Debian:14openexr3.4.14-0.1DEBIAN-CVE-2026-34589
PyPIopenexr3.4.9GHSA-p8xc-w3q4-h64x
PyPIopenexr3.2.7GHSA-p8xc-w3q4-h64x
PyPIopenexr3.3.9GHSA-p8xc-w3q4-h64x
PyPIopenexr3.2.7, 3.3.9, 3.4.9PYSEC-2026-2848
Ubuntu:26.10openexrno fix listedUBUNTU-CVE-2026-34589

Affected products (as reported)

VendorProductVersions
AcademySoftwareFoundation openexr >= 3.2.0, < 3.2.7>= 3.3.0, < 3.3.9>= 3.4.0, < 3.4.9

Weakness: CWE-190, CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References