Which versions of OpenEXR are affected by CVE-2026-27622?

OpenEXR library versions vulnerable to heap memory corruption pose a supply chain risk for organizations that process untrusted image files; while publicly available exploit code exists, extremely…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27622?

Yes, a public proof-of-concept exploit is available for CVE-2026-27622. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27622?

Within 24 hours: inventory applications and systems using OpenEXR and identify those processing untrusted or externally-sourced EXR files. Within 7 days: obtain and stage patched OpenEXR versions per vendor advisory and begin deployment to non-production environments for testing. Within 30 days: complete production rollout of patched versions and validate application functionality.

OpenEXR CVE-2026-27622

Q: What is the CVSS score of CVE-2026-27622?

CVE-2026-27622 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Out-of-bounds Write (CWE-787)

2026-03-03 security-advisories@github.com

GHSA-cr4v-6jm6-4963

Buffer Overflow Openexr Memory Corruption

8.4

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Trigger is a parsed malicious file (AV:L) opened by the user (UI:R) with no privileges (PR:N); a heap out-of-bounds write threatens full host C/I/A within the same scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:07 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:06 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:06 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:24 NVD

7.8 (HIGH) 8.4 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 05, 2026 - 21:07 vuln.today

Public exploit code

CVE Published

Mar 03, 2026 - 23:15 nvd

HIGH 7.8

DescriptionCVE.org

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.

AnalysisAI

Out-of-bounds heap write in OpenEXR's CompositeDeepScanLine::readPixels lets a crafted multi-part deep-scanline EXR file corrupt memory when parsed by an application that links the library. Attacker-controlled per-part sample counts are accumulated into 32-bit total_sizes entries that wrap modulo 2^32, yielding an undersized overall_sample_count used to size the composite sample buffer, while decode setup and generic_unpack_deep_pointers in core unpack consume the true (larger) counts and write past the buffer. Publicly available exploit code exists, but EPSS exploitation probability is very low (0.01%, 2nd percentile) and it is not listed in CISA KEV, so no public evidence of active exploitation exists at time of analysis.

Technical ContextAI

OpenEXR is the Academy Software Foundation's reference implementation of the EXR high-dynamic-range image format used throughout film and VFX pipelines; it underpins compositing, rendering, and image tools and ships as a shared library (libOpenEXR) on most Linux distributions. The flaw is a CWE-787 out-of-bounds write rooted in a 32-bit integer overflow: deep-scanline images store a variable number of samples per pixel, and CompositeDeepScanLine merges multiple image parts by accumulating per-pixel totals in a vector<unsigned int>. Because total_sizes elements are unsigned 32-bit, large attacker-supplied counts spread across many parts sum past 2^32 and wrap to a small value, from which overall_sample_count is derived and passed to samples[channel].resize(). The decode pointer setup and the C-core unpack routine generic_unpack_deep_pointers operate on the genuine, un-wrapped sample counts, so they iterate further than the shrunken buffer permits and overwrite adjacent heap memory.

RemediationAI

Vendor-released patch: upgrade OpenEXR to 3.2.6, 3.3.8, or 3.4.6 depending on the branch you run, per advisory GHSA-cr4v-6jm6-4963 (https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963). On managed distributions apply the corresponding vendor updates: SUSE SUSE-SU-2026:20936 (https://www.suse.com/support/update/SUSE-SU-2026:20936/), Ubuntu USN-8259-1 (https://ubuntu.com/security/notices/USN-8259-1), and the listed Red Hat RHSA errata, then restart or rebuild any long-running services and statically linked applications that bundle libOpenEXR. Where immediate patching is impossible, the practical compensating control is to stop feeding untrusted input to the affected code path: refuse or quarantine externally sourced deep-scanline / multi-part EXR files at ingestion, and route untrusted EXR decoding through a sandboxed or isolated worker (seccomp/container with no sensitive mounts) so a heap overrun cannot pivot - the trade-off is added pipeline latency and the operational cost of validating or transcoding files before they reach production tools. Avoid relying on file-extension filtering alone, since the trigger is the parsed content, not the name.

More in Openexr

View all

CVE-2018-18444 HIGH This Week POC

8.8 Oct 17

makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possib

CVE-2017-12596 HIGH This Week POC

7.8 Aug 07

In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp du

CVE-2026-26981 MEDIUM This Month POC

6.5 Feb 24

OpenEXR versions 3.3.0-3.3.6 and 3.4.0-3.4.4 are vulnerable to a heap buffer overflow in file parsing due to improper in

CVE-2021-3598 MEDIUM This Month POC

5.5 Jul 06

There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. Rated medium severity (CV

CVE-2020-16589 MEDIUM This Month POC

5.5 Dec 09

A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.

CVE-2020-16588 MEDIUM This Month POC

5.5 Dec 09

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp

CVE-2020-16587 MEDIUM This Month POC

5.5 Dec 09

A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruct

CVE-2020-11765 MEDIUM This Month POC

5.5 Apr 14