CVE-2026-34544
EUVD-2026-1806001.04.2026, 21:17
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, a crafted B44 or B44A EXR file can cause an out-of-bounds write in any application that decodes it via exr_decoding_run(). Consequences range from immediate crash (most likely) to corruption of adjacent heap allocations (layout-dependent). This issue has been patched in version 3.4.8.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openexr | openexr | 3.2.0 ≤ 𝑥 < 3.2.7 |
| openexr | openexr | 3.3.0 ≤ 𝑥 < 3.3.9 |
| openexr | openexr | 3.4.0 ≤ 𝑥 < 3.4.8 |
𝑥
= Vulnerable software versions
Amazon Linux Releases
Amazon Package | |||
|---|---|---|---|
| OpenEXR |
| ||
| OpenEXR-debuginfo |
| ||
| OpenEXR-devel |
| ||
| OpenEXR-libs |
| ||
| openexr |
| ||
| openexr-debuginfo |
| ||
| openexr-debugsource |
| ||
| openexr-devel |
| ||
| openexr-libs |
| ||
| openexr-libs-debuginfo |
|