Red Hat CVE-2026-34380

OpenEXR is the motion picture industry standard for high-dynamic-range image storage. The vulnerability resides in the PXR24 pixel format decoder (internal_pxr24.c, line 377), specifically in the undo_pxr24_impl() function which handles decompression of PXR24-encoded pixel data. The root cause is a signed integer overflow in the expression (uint64_t)(w * 3), where the multiplication w * 3 is computed as a signed 32-bit integer before casting to unsigned 64-bit. According to the C standard, this constitutes undefined behavior. When w contains large values, two's-complement wraparound commonly occurs on typical compilers (clang, gcc). For specific w values, the wrapped result becomes a small positive integer, allowing a subsequent buffer bounds check to pass incorrectly. Once the bounds check is bypassed, the decoding loop writes pixel data beyond the allocated output buffer, causing heap overflow. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound), which is the root cause of the subsequent buffer overflow condition.