Openexr EUVD-2026-24046

Requires victim to open or process a specially crafted EXR file using DWA compression codec in an application linked against vulnerable OpenEXR versions (3.2.0-3.2.7, 3.3.0-3.3.9, or 3.4.0-3.4.9). Exploitation is limited to local attack vectors - the malicious file must be delivered via email attachment, file sharing, asset repositories, or other content distribution channels used in media production workflows. No network services directly exploitable. User interaction is mandatory (UI:A) as the victim must actively open or import the file. No authentication or elevated privileges required on the target system (PR:N). The vulnerability specifically affects the DWA compressor code path; EXR files using other compression methods (ZIP, PIZ, RLE) are not affected by this particular integer overflow instance. Successful exploitation probability increases in environments with automated EXR processing pipelines that lack input validation, though most professional VFX software includes some degree of file integrity checking that may detect malformed files.

The vulnerability presents moderate-to-high risk in targeted attack scenarios despite the 8.4 CVSS score. The CVSS:4.0 vector confirms local attack vector (AV:L) with low complexity (AC:L) but requires user interaction (UI:A) - specifically, a victim must open or process a maliciously crafted EXR file. No privileges are required (PR:N) once the file is delivered. The high confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) indicate potential for complete system compromise if exploitation succeeds. Real-world risk assessment: OpenEXR is ubiquitous in film/VFX pipelines where users routinely process third-party asset files, creating realistic social engineering attack surfaces. The regression nature (missed in prior CVE-2026-34589 batch) suggests incomplete remediation processes. However, the local-only attack vector and lack of CISA KEV listing indicate this is not being exploited at scale. No public POC is confirmed in available data, though the technical details provided (specific line number, overflow pattern) could enable proof-of-concept development. Priority should be high for organizations in media production sectors handling untrusted EXR files, moderate for general-purpose systems where OpenEXR is a dependency. Missing data: EPSS exploitation probability score, actual POC availability, and confirmation of whether this affects only file decompression or also compression workflows.

An attacker crafts a malicious EXR image file with dimension metadata designed to trigger integer overflow when width and height are multiplied (e.g., width=65536, height=32768, exceeding 2^31). A visual effects artist or automated rendering pipeline opens this file in software using vulnerable OpenEXR libraries. The undersized buffer allocation leads to heap corruption when decompression writes full image data, allowing the attacker to execute arbitrary code with the privileges of the processing application, potentially compromising the production workstation or render farm node.