What is the CVSS score of CVE-2026-27622?

CVE-2026-27622 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-27622?

Yes, a public proof-of-concept exploit is available for CVE-2026-27622. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27622?

Within 24 hours: inventory applications and systems using OpenEXR and identify those processing untrusted or externally-sourced EXR files. Within 7 days: obtain and stage patched OpenEXR versions per vendor advisory and begin deployment to non-production environments for testing. Within 30 days: complete production rollout of patched versions and validate application functionality.

OpenEXR CVE-2026-27622

HIGH

Out-of-bounds Write (CWE-787)

2026-03-03 security-advisories@github.com

GHSA-cr4v-6jm6-4963

Buffer Overflow Memory Corruption Openexr

8.4

CVSS 4.0 · Vendor: github

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious multi-part deep EXR
Delivery

Deliver file to processing pipeline
Exploit

Victim app opens and reads pixels
Execution

32-bit sample total wraps, buffer undersized
Persist

Deep unpack writes past heap buffer
Impact

Memory corruption, crash or code execution

Vulnerability Assessment

Weakness	CWE CWE-787 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the target application to parse an attacker-supplied EXR file through the deep-image compositing path - specifically CompositeDeepScanLine::readPixels on a multi-part, deep-scanline image whose per-part sample counts are large enough that their sum wraps past 2^32. The limiting factors are concrete: the vector is local with required user/application interaction (UI:A) - a victim or an automated service must actually open the crafted file, so there is no remote unauthenticated network trigger; the image must use the deep multi-part format and exercise the composite read path rather than ordinary scanline/tiled reads; and the host must run an unpatched OpenEXR (pre-3.2.6/3.3.8/3.4.6). No authentication or elevated privileges are needed (PR:N), but reliable code execution beyond a crash depends on heap layout and platform, which the data does not confirm.
Impact	Signals are consistent and point to a real but parsing-dependent memory-corruption bug rather than a remotely wormable one. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H, base 8.4) describes a local attack vector requiring user/application interaction to open a malicious file, with no privileges needed and high impact to confidentiality, integrity and availability of the processing host; scope to subsequent systems is none. EPSS is extremely low (0.01%, 2nd percentile) and the CVE is not in CISA KEV, indicating no observed mass exploitation. Public exploit/PoC code is referenced via the GitHub Security Advisory, which raises practical risk above a theoretical bug, but PoC availability is not the same as active exploitation. The key nuance defenders should weigh: 'local' here means the malicious data is a file or image stream, which in many pipelines is effectively attacker-supplied content (render farms, asset ingestion, thumbnailers), so the real-world exposure depends heavily on whether untrusted EXR files reach an OpenEXR-linked process. Net: a credible priority for environments that process untrusted EXR content, lower priority for closed pipelines.
Exploit ScenarioDerived	An attacker crafts a malicious multi-part deep-scanline EXR file with sample counts engineered to overflow the 32-bit total accumulator and submits it to a target that auto-processes images - a render farm asset, an uploaded texture, or a thumbnail/preview pipeline. When the OpenEXR-linked application opens the file, the undersized composite buffer is overrun during deep unpacking, corrupting heap memory and crashing the process or potentially steering execution. Public PoC code referenced in the GitHub advisory lowers the bar to reproduce the overflow.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv4 – Jun 30, 2026

Out-of-bounds heap write in OpenEXR's CompositeDeepScanLine::readPixels lets a crafted multi-part deep-scanline EXR file corrupt memory when parsed by an application that links the library. Attacker-controlled per-part sample counts are accumulated into 32-bit total_sizes entries that wrap modulo 2^32, yielding an undersized overall_sample_count used to size the composite sample buffer, while decode setup and generic_unpack_deep_pointers in core unpack consume the true (larger) counts and write past the buffer. Publicly available exploit code exists, but EPSS exploitation probability is very low (0.01%, 2nd percentile) and it is not listed in CISA KEV, so no public evidence of active exploitation exists at time of analysis.

Earlier versions of this analysis (3)

v3 Jun 30, 2026 - 05:06 cvss changed CVSS 8.4

Heap out-of-bounds write in OpenEXR's deep-image compositing path (CompositeDeepScanLine::readPixels) lets an attacker craft a multi-part deep EXR file that corrupts memory when opened by an application linked against the OpenEXR reference library. Per-pixel sample totals accumulated across many parts wrap modulo 2^32, producing an undersized composite sample buffer that the core deep-unpack routine then overruns with real (unwrapped) sample counts. Publicly available exploit code exists, though EPSS is very low (0.01%) and the issue is not in CISA KEV.

v2 Jun 30, 2026 - 05:06 cvss changed CVSS 8.4

Out-of-bounds heap write in OpenEXR's deep-image compositing path (CompositeDeepScanLine::readPixels) lets a maliciously crafted multi-part EXR file corrupt memory when parsed by an application using the library. Integer overflow of per-pixel totals causes an undersized sample buffer to be allocated while the core deep-unpack routine writes using true sample counts, enabling memory corruption and likely arbitrary code execution in the context of the decoding process. Publicly available exploit code exists; EPSS is very low (0.01%) and the flaw is not listed in CISA KEV, so there is no public exploit identified as actively exploited in the wild.

v1 Mar 12, 2026 - 22:05 CVSS 7.8

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. [CVSS 7.8 HIGH]

RemediationAI

Vendor-released patch: upgrade OpenEXR to 3.2.6, 3.3.8, or 3.4.6 depending on the branch you run, per advisory GHSA-cr4v-6jm6-4963 (https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963). On managed distributions apply the corresponding vendor updates: SUSE SUSE-SU-2026:20936 (https://www.suse.com/support/update/SUSE-SU-2026:20936/), Ubuntu USN-8259-1 (https://ubuntu.com/security/notices/USN-8259-1), and the listed Red Hat RHSA errata, then restart or rebuild any long-running services and statically linked applications that bundle libOpenEXR. Where immediate patching is impossible, the practical compensating control is to stop feeding untrusted input to the affected code path: refuse or quarantine externally sourced deep-scanline / multi-part EXR files at ingestion, and route untrusted EXR decoding through a sandboxed or isolated worker (seccomp/container with no sensitive mounts) so a heap overrun cannot pivot - the trade-off is added pipeline latency and the operational cost of validating or transcoding files before they reach production tools. Avoid relying on file-extension filtering alone, since the trigger is the parsed content, not the name.

Affected Packages

pypi openexr fix: 3.2.6, 3.3.8, 3.4.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

OpenEXR is the Academy Software Foundation's reference implementation of the EXR high-dynamic-range image format used throughout film and VFX pipelines; it underpins compositing, rendering, and image tools and ships as a shared library (libOpenEXR) on most Linux distributions. The flaw is a CWE-787 out-of-bounds write rooted in a 32-bit integer overflow: deep-scanline images store a variable number of samples per pixel, and CompositeDeepScanLine merges multiple image parts by accumulating per-pixel totals in a vector<unsigned int>. Because total_sizes elements are unsigned 32-bit, large attacker-supplied counts spread across many parts sum past 2^32 and wrap to a small value, from which overall_sample_count is derived and passed to samples[channel].resize(). The decode pointer setup and the C-core unpack routine generic_unpack_deep_pointers operate on the genuine, un-wrapped sample counts, so they iterate further than the shrunken buffer permits and overwrite adjacent heap memory.

Know when Openexr gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 7.8 HIGH

Trigger is a parsed malicious file (AV:L) opened by the user (UI:R) with no privileges (PR:N); a heap out-of-bounds write threatens full host C/I/A within the same scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat 7.4 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Active

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Jun 30, 2026 - 03:24 NVD

7.8 (HIGH) 8.4 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 05, 2026 - 21:07 vuln.today

Public exploit code

CVE Published

Mar 03, 2026 - 23:15 nvd

HIGH 7.8

DescriptionCVE.org

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.

Executive ViewAI

Why It Matters

OpenEXR library versions vulnerable to heap memory corruption pose a supply chain risk for organizations that process untrusted image files; while publicly available exploit code exists, extremely low exploitation probability (0.01% EPSS) and no evidence of active exploitation suggest immediate organizational exposure is minimal, enabling controlled patch deployment.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Prevalence

High

core image library across film/VFX tools and most Linux distributions

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

NVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Affected Products (CPE)CVE.org

cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*

More in Openexr

View all

CVE-2018-18444 HIGH This Week POC

8.8 Oct 17

makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possib

CVE-2017-12596 HIGH This Week POC

7.8 Aug 07

In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp du

CVE-2026-26981 MEDIUM This Month POC

6.5 Feb 24

OpenEXR versions 3.3.0-3.3.6 and 3.4.0-3.4.4 are vulnerable to a heap buffer overflow in file parsing due to improper in

CVE-2021-3598 MEDIUM This Month POC

5.5 Jul 06

There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. Rated medium severity (CV

CVE-2020-16589 MEDIUM This Month POC

5.5 Dec 09

A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.

CVE-2020-16588 MEDIUM This Month POC

5.5 Dec 09

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp

CVE-2020-16587 MEDIUM This Month POC

5.5 Dec 09

A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruct

CVE-2020-11765 MEDIUM This Month POC

5.5 Apr 14