Vulnerability · Published Apr 1, 2026 · Assigned by GitHub_M
CVE-2026-34544OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
High 8.4
In plain English
A high-severity integer overflow in openexr from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, a crafted B44 or B44A EXR file can cause an out-of-bounds write in any application that decodes it via exr_decoding_run(). Consequences range from immediate crash (most likely) to corruption of adjacent heap allocations (layout-dependent). This issue has been patched in version 3.4.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | openexr | 3.1.10-8.el10_2.5 | ALSA-2026:84796 |
| AlmaLinux:10 | openexr-devel | 3.1.10-8.el10_2.5 | ALSA-2026:84796 |
| AlmaLinux:9 | openexr-devel | 3.1.1-3.el9_8.5 | ALSA-2026:86983 |
| AlmaLinux:10 | openexr-libs | 3.1.10-8.el10_2.5 | ALSA-2026:84796 |
| Alpine:v3.22 | openexr | 3.3.11-r0 | ALPINE-CVE-2026-34544 |
| Alpine:v3.23 | openexr | 3.4.13-r0 | ALPINE-CVE-2026-34544 |
| Alpine:v3.24 | openexr | 3.4.10-r0 | ALPINE-CVE-2026-34544 |
| Debian:12 | openexr | no fix listed | DEBIAN-CVE-2026-34544 |
| Debian:13 | openexr | no fix listed | DEBIAN-CVE-2026-34544 |
| Debian:14 | openexr | 3.4.14-0.1 | DEBIAN-CVE-2026-34544 |
| PyPI | openexr | no fix listed | GHSA-h762-rhv3-h25v |
| PyPI | openexr | no fix listed | GHSA-h762-rhv3-h25v |
| PyPI | openexr | 3.4.8 | PYSEC-2026-2847 |
| PyPI | openexr | 3.4.8 | GHSA-h762-rhv3-h25v |
| Rocky Linux:10 | openexr | 0:3.1.10-8.el10_2.5 | RLSA-2026:84796 |
| Rocky Linux:9 | openexr | 0:3.1.1-3.el9_8.5 | RLSA-2026:86983 |
| Ubuntu:26.10 | openexr | no fix listed | UBUNTU-CVE-2026-34544 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.4.0, < 3.4.8 |
Weakness: CWE-190, CWE-787 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-h762-rhv3-h25v x_refsource_CONFIRM
- https://github.com/AcademySoftwareFoundation/openexr/commit/35e7aa35e22c1975606be86e859f31cc1fc598ee x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8 x_refsource_MISC