Openexr CVE-2026-34380

The CVSS v3.1 score of 5.9 reflects moderate real-world risk with nuanced signal interpretation. The attack vector is network-based (AV:N) and requires no authentication (PR:N), but high attack complexity (AC:H) and user interaction (UI:R) significantly reduce practical exploitability. The impact assessment shows no confidentiality impact (C:N), limited integrity impact (I:L), and high availability impact (A:H)-consistent with a denial-of-service scenario via file corruption or application crash. The high AC:H and UI:R requirements indicate this is not trivially exploitable: an attacker must craft a specific malicious EXR file and convince a user or automated system to process it, and the exploitation path depends on compiler behavior and memory layout. EPSS data is not provided, but based on attack complexity and user interaction requirements, real-world exploitation probability is likely below the base CVSS suggests. The lack of confirmed public exploit code or CISA KEV status further lowers immediate threat, though this is a network-reachable code path in image processing pipelines (video editors, rendering systems). This should be prioritized for patching in systems that automatically process untrusted EXR files, but is lower-priority in closed environments with curated content.

An attacker crafts a malicious EXR file containing a PXR24-compressed image with carefully chosen width (w) values designed to trigger two's-complement wraparound in the w * 3 multiplication, bypassing the bounds check in undo_pxr24_impl(). The attacker distributes the file via email, a web service, or network share, targeting users or automated systems (e.g., render farms, video editing software) that process EXR files. When the vulnerable OpenEXR library decodes the file, the bounds check is bypassed and the decoder writes pixel data beyond the output buffer, corrupting heap memory. This typically results in a denial-of-service crash; data corruption or code execution depends on heap layout and is probabilistic. High attack complexity (AC:H) and required user interaction (UI:R) mean successful exploitation depends on the victim actually processing the malicious file, making this less critical than network-worm scenarios but still significant in render-on-demand or automated image processing pipelines.