CVE-2026-27622
HIGH
GHSA-cr4v-6jm6-4963
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.
Analysis
Buffer overflow in OpenEXR's CompositeDeepScanLine::readPixels function allows local attackers to achieve code execution by crafting malicious EXR files that trigger integer wraparound in sample count calculations, resulting in undersized memory allocation followed by heap buffer overrun during decompression. Public exploit code exists for this vulnerability, and patches are available in versions 3.2.6, 3.3.8, and 3.4.6. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all systems and applications using OpenEXR; restrict access to EXR processing functions to trusted users/networks only; disable EXR import/processing features if not business-critical. Within 7 days: Implement network segmentation to isolate systems handling EXR files; deploy input validation and sandboxing for EXR file processing; establish monitoring for exploitation attempts. …
Sign in for detailed remediation steps.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today