CVE-2026-34588

EUVD-2026-19347

06.04.2026, 16:16

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 39.72%

Affected Products (NVD)

Vendor	Product	Version
openexr	openexr	3.1.0 ≤ 𝑥 < 3.2.7
openexr	openexr	3.3.0 ≤ 𝑥 < 3.3.9
openexr	openexr	3.4.0 ≤ 𝑥 < 3.4.9

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Enterprise Linux 10	0:3.1.10-8.el10_1.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 10	0:3.1.10-8.el10_2.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	0:3.1.10-8.el10_0.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	0:3.1.1-3.el9_7.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	0:3.1.1-3.el9_8.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	0:3.1.1-2.el9_0.3 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	0:3.1.1-2.el9_2.3 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	0:3.1.1-2.el9_4.3 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	0:3.1.1-3.el9_6.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat AI Inference Server 3.3	1782352950 ≤ 𝑥 < *	ADP
Red Hat	Red Hat AI Inference Server 3.3	1782352919 ≤ 𝑥 < *	ADP
Red Hat	Red Hat AI Inference Server 3.3	1782353093 ≤ 𝑥 < *	ADP
Red Hat	Red Hat AI Inference Server 3.3	1782352847 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

openexr

bookworm	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

openexr

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	Fixed 3.1.5-5.1ubuntu0.1~esm1 released
questing	ignored
resolute	Fixed 3.1.13-2ubuntu0.26.04.1~esm1 released
xenial	not-affected