Red Hat CVE-2026-34378

OpenEXR is a widely-used image format library in visual effects and motion picture production, providing both specification and reference implementation via OpenEXRCore. The vulnerability stems from a missing bounds check on the dataWindow attribute-specifically the minimum x-coordinate-in the EXR file header parsing logic. When an attacker supplies a large negative value for dataWindow.min.x, OpenEXRCore computes an image width that wraps around during signed integer arithmetic, resulting in an enormous computed width. This malformed width is subsequently used in a signed integer multiplication operation within generic_unpack(), causing integer overflow behavior. Modern C++ compilers with undefined behavior sanitization (UBSan) detect this overflow and terminate the process with SIGILL (illegal instruction signal), creating a denial-of-service condition. The root cause is classified as CWE-190 (Integer Overflow or Wraparound).