Openexr CVE-2026-40250

Exploitation requires the victim to open a maliciously crafted EXR file using an application built with affected OpenEXR library versions (3.2.0-3.2.7, 3.3.0-3.3.9, or 3.4.0-3.4.9). The file must specifically employ DWA compression with crafted channel dimensions that trigger the integer overflow at internal_dwa_compressor.h:1040. User interaction is mandatory (UI:A)-the attack cannot proceed without a user actively opening or processing the file. No authentication is required (PR:N), and attack complexity is low (AC:L) once the malicious file is delivered. Limiting factors include: local attack vector only (AV:L) preventing remote server exploitation, requirement for social engineering to achieve file delivery, and potential mitigation by operating system or application sandboxing that restricts post-exploitation impact.

Real-world exploitation risk is moderate despite the CVSS 8.4 score. The attack vector is local with mandatory user interaction (AV:L/UI:A), requiring attackers to convince users to open malicious EXR files-this is not a remotely exploitable server-side vulnerability. Attack complexity is low (AC:L) once the malicious file is delivered, and no privileges are required (PR:N). The high confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) reflect potential for code execution within the application's security context. However, scope is unchanged (SC:N), limiting lateral movement. No EPSS score or KEV listing available in provided data, suggesting no confirmed widespread or automated exploitation. The vulnerability affects workstation environments where artists and technicians process untrusted EXR files, particularly in media production pipelines handling third-party assets. Risk is elevated in environments lacking application sandboxing or where users routinely process EXR files from external sources. The existence of three related CVEs (34589, 34588, 34544) indicates systematic integer overflow issues in OpenEXR's codebase, suggesting attackers familiar with one variant could readily adapt exploits for this missed instance. Primary risk: targeted attacks against visual effects studios, game developers, or architectural visualization firms through malicious asset delivery.

An attacker crafts a malicious EXR file with extreme channel width values designed to trigger integer overflow during DWA decompression buffer allocation. The attacker delivers this file to a visual effects artist via phishing email disguised as production assets, shared cloud storage, or compromised asset library. When the victim opens the file in an OpenEXR-based application (compositing software, image viewer, or automated render pipeline), the undersized buffer allocation leads to heap corruption, potentially achieving arbitrary code execution within the application's privilege context.