Openexr CVE-2026-34544

Victim must open a crafted B44 or B44A compressed EXR file in any application using OpenEXR versions 3.4.0-3.4.7. No authentication required. Local user interaction (file opening) necessary. AV:L indicates local attack surface.

Real-world risk is moderate despite the High CVSS score. The CVSS:4.0 vector (AV:L/AC:L/PR:N/UI:A) confirms local attack vector with low complexity but mandatory user interaction, limiting exploit scenarios to social engineering or supply-chain insertion of malicious EXR files into production workflows. EPSS data not provided, but no CISA KEV listing and no public exploit code reduces immediate threat urgency. The vulnerability's impact (VC:H/VI:H/VA:H) enables confidentiality breach, integrity violation, and availability disruption within the vulnerable application's context, though scope is unchanged (SC:N/SI:N/SA:N) preventing lateral system compromise. Exploitation requires convincing a user to process a crafted file through an OpenEXR-linked application, making this a targeted rather than mass-exploitation threat. Priority should be elevated for organizations in media production, VFX studios, or any environment routinely processing untrusted EXR files from external sources. The availability of detailed commit-level fixes and GitHub advisory increases long-term risk as attackers can reverse-engineer the patch to develop exploits.

An attacker crafts a malicious EXR file with manipulated B44 compression metadata causing integer overflow in buffer size calculations during decompression. A visual effects artist receives the file as part of an asset delivery from an external vendor or downloads it from a compromised stock image repository. When the artist opens the file in their compositing software (Nuke, After Effects) or 3D application (Blender, Maya), the vulnerable exr_decoding_run() function allocates an undersized heap buffer and writes decompressed image data beyond its bounds. Most likely outcome is immediate application crash with potential work loss. In layout-dependent scenarios where adjacent heap allocations contain function pointers or critical data structures, the attacker could achieve arbitrary code execution within the application's process context, potentially accessing sensitive project files or compromising the workstation. Public exploit code not identified at time of analysis, but detailed commit-level patch information enables motivated attackers to develop reliable exploits through diff analysis.