Skip to main content

Openexr CVE-2026-34588

| EUVDEUVD-2026-19347 HIGH
Out-of-bounds Read (CWE-125)
2026-04-06 GitHub_M GHSA-588r-cr5c-w6hf
Buffer Overflow Information Disclosure Openexr Academysoftwarefoundation
8.6
CVSS 4.0 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious EXR file with oversized dimensions
  2. Delivery
    Load file in OpenEXR application
  3. Exploit
    Trigger signed integer overflow in wavelet pointer arithmetic
  4. Execution
    Read/write memory out-of-bounds
  5. Impact
    Corrupt heap or leak sensitive data

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Attacker must craft a malicious EXR file with specific nx, ny, and wcount values triggering signed 32-bit integer overflow in internal_exr_undo_piz(). Victim must open the file in OpenEXR 3.1.0–3.2.6, 3.3.0–3.3.8, or 3.4.0–3.4.8.
Impact

Real-world risk is moderate-to-high for environments processing untrusted EXR files. The CVSS:4.0 score of 8.6 reflects local attack vector (AV:L) with low complexity (AC:L) and no privileges required (PR:N), but requires the victim to process a malicious file (implicit user interaction in file handling workflows). High impact ratings (VC:H/VI:H/VA:H) indicate potential for information disclosure, memory corruption, and denial of service. However, the local attack vector limits remote exploitation scenarios-attackers need the victim to open a crafted EXR file, reducing immediate internet-scale risk compared to network-exploitable flaws. No EPSS score is provided, and no public exploit identified at time of analysis, suggesting this has not yet been incorporated into attacker toolkits. The GitHub Security Advisory (GHSA-588r-cr5c-w6hf) confirms vendor acknowledgment and patching. For production pipelines automatically processing user-submitted or external EXR files (render farms, asset management systems), this represents a significant risk. For desktop applications where users consciously open files, risk depends on trust boundaries and file provenance controls.
Exploit ScenarioDerived

An attacker crafts a malicious EXR file with specially chosen dimensions and channel counts designed to overflow the nx * ny * wcount calculation in the PIZ decompression routine. When a visual effects artist opens this file in an OpenEXR-based application (e.g., image viewer, compositing software, or automated render pipeline), the integer overflow corrupts the wavelet buffer pointer. The subsequent out-of-bounds memory access could leak sensitive data from adjacent memory regions (information disclosure), corrupt application state leading to crashes (denial of service), or potentially be leveraged for code execution if combined with additional exploitation techniques. No public exploit identified at time of analysis, but the low attack complexity and clear mathematical trigger condition make proof-of-concept development straightforward for attackers with reverse-engineering capabilities.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 06, 2026

Integer overflow in OpenEXR's PIZ wavelet decompression leads to out-of-bounds memory access when processing malicious EXR image files. Affects OpenEXR 3.1.0 through 3.2.6, 3.3.0-3.3.8, and 3.4.0-3.4.8. Local attackers can trigger memory corruption through crafted EXR files without authentication (CVSS:4.0 AV:L/PR:N), achieving high confidentiality, integrity, and availability impact. EPSS data not available; no public exploit identified at time of analysis. Vendor-released patches available in versions 3.2.7, 3.3.9, and 3.4.9.

RemediationAI

Upgrade to patched OpenEXR versions: 3.2.7 (for 3.2.x branch users), 3.3.9 (for 3.3.x users), or 3.4.9 (for 3.4.x users). Organizations should inventory all systems using OpenEXR libraries, including bundled dependencies in commercial applications (e.g., Adobe products, Foundry Nuke, Autodesk tools), and apply vendor-provided updates. For systems unable to upgrade immediately, implement strict input validation to reject EXR files from untrusted sources, run EXR processing in sandboxed environments with minimal privileges, and monitor for unexpected crashes or memory access violations. Review the GitHub Security Advisory at https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf for additional technical details and coordinate with application vendors who bundle OpenEXR to ensure downstream patches are released.

Affected VersionsENISA

OpenEXR 3.1.0, ≤ 3.1.13
OpenEXR 3.4.0, < 3.4.9
OpenEXR 3.3.0, < 3.3.9
OpenEXR 3.2.0, < 3.2.7

Affected Packages

pypi openexr fix: 3.2.7, 3.3.9, 3.4.9

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

OpenEXR is the Academy Software Foundation's reference implementation for the EXR high-dynamic-range image format widely used in visual effects and animation pipelines. The vulnerability resides in internal_exr_undo_piz(), part of the PIZ wavelet-based compression codec. During decompression, the function calculates wavelet buffer offsets using signed 32-bit integer arithmetic (nx * ny * wcount). A maliciously crafted EXR file can supply dimension and channel parameters that cause this multiplication to exceed INT_MAX, wrapping to a negative or incorrect positive value. The corrupted pointer then causes subsequent wavelet decoding operations to read from and write to unintended memory locations. This maps to CWE-125 (Out-of-bounds Read) but also involves writes due to the in-place decoding design. The affected CPE (cpe:2.3:a:academysoftwarefoundation:openexr) covers all distributions of the library across multiple major version branches introduced starting with the 3.1.0 refactor.

Know when Openexr gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.6 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 8.8 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Apr 08, 2026 - 20:30 nvd
Patch available
CVE Published
Apr 06, 2026 - 15:31 nvd
HIGH 8.6

DescriptionCVE.org

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.

Executive ViewAI

Why It Matters

CVE-2026-34588 is a high-severity integer overflow vulnerability in OpenEXR's image decompression that enables local attackers to corrupt memory and crash applications or read sensitive data by processing malicious image files. Organizations using OpenEXR 3.1-3.4.8 in content creation, visual effects, or image processing pipelines face data loss and operational disruption if attackers gain local system access.

Business Impact: High
Compensating Controls

Vendor-released patch: versions 3.2.7, 3.3.9, and 3.4.9. Until patching is complete, restrict local system access to trusted users only, disable EXR file processing from untrusted sources, and implement strict file format validation at application entry points.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Threat Intel
1
1 source
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

43
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +43
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in OpenEXR Buffer Overflow Vulnerabilities

View all 2
CVE-2026-34379 HIGH
7.1

More in Openexr

View all
CVE-2018-18444 HIGH POC
8.8 Oct 17

makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possib
CVE-2026-27622 HIGH POC
8.4 Mar 03

Out-of-bounds heap write in OpenEXR's CompositeDeepScanLine::readPixels lets a crafted multi-part deep-scanline EXR file
CVE-2017-12596 HIGH POC
7.8 Aug 07

In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp du
CVE-2026-26981 MEDIUM POC
6.5 Feb 24

OpenEXR versions 3.3.0-3.3.6 and 3.4.0-3.4.4 are vulnerable to a heap buffer overflow in file parsing due to improper in
CVE-2021-3598 MEDIUM POC
5.5 Jul 06

There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. Rated medium severity (CV
CVE-2020-16589 MEDIUM POC
5.5 Dec 09

A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.
CVE-2020-16588 MEDIUM POC
5.5 Dec 09

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp
CVE-2020-16587 MEDIUM POC
5.5 Dec 09

A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruct
CVE-2020-11765 MEDIUM POC
5.5 Apr 14

An issue was discovered in OpenEXR before 2.4.1. Rated medium severity (CVSS 5.5), this vulnerability is no authenticati
CVE-2020-11764 MEDIUM POC
5.5 Apr 14

An issue was discovered in OpenEXR before 2.4.1. Rated medium severity (CVSS 5.5), this vulnerability is no authenticati
CVE-2020-11763 MEDIUM POC
5.5 Apr 14

An issue was discovered in OpenEXR before 2.4.1. Rated medium severity (CVSS 5.5), this vulnerability is no authenticati
CVE-2020-11762 MEDIUM POC
5.5 Apr 14

An issue was discovered in OpenEXR before 2.4.1. Rated medium severity (CVSS 5.5), this vulnerability is no authenticati

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34588 ADVISORY https://ubuntu.com/security/notices/USN-8259-1 ADVISORY https://vuldb.com/vuln/355561 REF https://access.redhat.com/errata/RHSA-2026:15887 REF https://access.redhat.com/errata/RHSA-2026:15888 REF https://access.redhat.com/errata/RHSA-2026:17656 REF https://access.redhat.com/errata/RHSA-2026:17658 REF https://access.redhat.com/errata/RHSA-2026:17659 REF https://access.redhat.com/errata/RHSA-2026:17660 REF https://access.redhat.com/errata/RHSA-2026:19146 REF https://access.redhat.com/errata/RHSA-2026:19359 REF https://access.redhat.com/errata/RHSA-2026:19587 REF https://access.redhat.com/errata/RHSA-2026:30078 REF https://access.redhat.com/errata/RHSA-2026:30087 REF https://access.redhat.com/errata/RHSA-2026:30088 REF https://access.redhat.com/errata/RHSA-2026:30089 REF https://access.redhat.com/security/cve/CVE-2026-34588 REF https://bugzilla.redhat.com/show_bug.cgi?id=2455408 REF https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.7 REF https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.9 REF https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9 REF https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34588.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy