Openexr CVE-2026-34589

Victim must open a crafted EXR file with large width using OpenEXR 3.2.0-3.2.6, 3.3.0-3.3.8, or 3.4.0-3.4.8 with DWA lossy compression enabled. Local attacker or remote attacker sending the file. Integer overflow in signed 32-bit pointer arithmetic during DWA decoder block processing.

The CVSS v4.0 score of 8.4 (High severity) reflects significant potential impact with local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:A). The vulnerability enables high confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H). However, real-world risk is moderated by several factors: the attack requires the victim to open a specially crafted EXR file using vulnerable software, limiting exploitation to social engineering or supply chain scenarios where malicious images are introduced into production pipelines. The local attack vector means remote exploitation requires combining this with other delivery mechanisms. No EPSS score is provided in the intelligence data, but the lack of CISA KEV listing and absence of public exploit code suggests this is not yet actively exploited in the wild. The buffer overflow condition could theoretically enable arbitrary code execution in the context of the application processing the image, making this a legitimate concern for environments handling untrusted EXR files from external sources. Organizations using OpenEXR in automated processing pipelines or accepting user-uploaded EXR content face elevated risk. The availability of patches across multiple maintenance branches (3.2.x, 3.3.x, 3.4.x) and the specificity of the vulnerability disclosure in the GitHub security advisory indicate this is a well-understood and addressable issue, reducing long-term risk for organizations with effective patch management.

An attacker crafts a malicious EXR image file with DWA compression and carefully selected image dimensions that trigger integer overflow in the decoder's width calculations. The attacker distributes this file through a visual effects asset repository, stock image platform, or targeted phishing campaign to visual effects artists or automated media processing systems. When a victim opens the malicious EXR file in vulnerable software (such as image viewers, compositing applications, or automated rendering pipelines running OpenEXR 3.2.0-3.2.6), the DWA decoder's overflowed pointer writes attacker-controlled data outside allocated memory bounds, potentially achieving arbitrary code execution in the context of the processing application and enabling further system compromise.