Openexr EUVD-2026-18058

OpenEXR versions 3.4.0 through 3.4.7. Remote attacker can craft a malicious EXR file. Victim must open or process the file using vulnerable OpenEXR library. No authentication, user interaction, or special configuration required—default settings affected.

Real-world risk is HIGH for environments processing untrusted EXR files, despite absence of active exploitation indicators. The CVSS 8.7 score accurately reflects severity: network attack vector (AV:N) with no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L) create trivial exploitation conditions once attack techniques emerge. High confidentiality impact (VC:H) means attackers can extract arbitrary heap contents, potentially including cryptographic keys, authentication tokens, or other sensitive process memory. The vulnerability's technical impact is automatable through malicious file generation, satisfying SSVC criteria for urgent remediation in exposed systems. However, exploitation requires victims to process attacker-supplied EXR files, limiting immediate risk to applications accepting external media inputs. Organizations in visual effects, medical imaging, scientific visualization, or any sector handling EXR formats should prioritize patching, especially for internet-facing services. The absence of public exploit code reduces immediate threat but should not delay remediation given the straightforward nature of information disclosure vulnerabilities and their value in multi-stage attacks.

An attacker crafts a malicious EXR image file with specific header values that trigger uninitialized heap buffer usage during pixel decoding. When a victim application (such as an automated media processing service, visual effects rendering pipeline, or image conversion API) processes this file, the OpenEXR library leaks heap memory contents into the decoded pixel data. The attacker retrieves the processed image through normal application workflows (download, API response, or shared storage), then extracts sensitive information from the pixel values, potentially recovering cryptographic keys, session tokens, or fragments of other users' data from the application's memory space.