CVE-2026-27622

EUVD-2026-9342

03.03.2026, 23:15

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 9.96%

Affected Products (NVD)

Vendor	Product	Version
openexr	openexr	𝑥 < 3.2.6
openexr	openexr	3.3.0 ≤ 𝑥 < 3.3.8
openexr	openexr	3.4.0 ≤ 𝑥 < 3.4.6

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Enterprise Linux 10	0:3.1.10-8.el10_1.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	0:3.1.10-8.el10_0.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8	0:2.2.0-12.el8_10.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	0:2.2.0-11.el8_2.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	0:2.2.0-12.el8_4.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	0:2.2.0-12.el8_4.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	0:2.2.0-12.el8_6.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	0:2.2.0-12.el8_6.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	0:2.2.0-12.el8_6.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	0:2.2.0-12.el8_8.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	0:2.2.0-12.el8_8.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	0:3.1.1-3.el9_7.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	0:3.1.1-2.el9_0.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	0:3.1.1-2.el9_2.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	0:3.1.1-2.el9_4.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	0:3.1.1-3.el9_6.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat AI Inference Server 3.3	1778244559 ≤ 𝑥 < *	ADP
Red Hat	Red Hat AI Inference Server 3.3	1778244531 ≤ 𝑥 < *	ADP
Red Hat	Red Hat AI Inference Server 3.3	1778274666 ≤ 𝑥 < *	ADP
Red Hat	Red Hat AI Inference Server 3.3	1778244546 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

openexr

bookworm	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
forky	3.4.6+ds-4 fixed
sid	3.4.14-0.1 fixed
trixie	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

openexr

bionic	Fixed 2.2.0-11.1ubuntu1.9+esm1 released
focal	Fixed 2.3.0-6ubuntu0.5+esm2 released
jammy	Fixed 2.5.7-1ubuntu0.1~esm2 released
noble	Fixed 3.1.5-5.1ubuntu0.1~esm1 released
questing	ignored
resolute	Fixed 3.1.13-2ubuntu0.26.04.1~esm1 released
xenial	Fixed 2.2.0-10ubuntu2.6+esm4 released