CVE-2026-27622

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.6 OpenEXR versions prior to 3.3.8 OpenEXR versions prior to 3.4.6

Description OpenEXR, a file format used in the motion picture industry, has an issue in the CompositeDeepScanLine::readPixels function. The function accumulates per-pixel totals in a vector named total sizes. When handling attacker-controlled large counts across multiple parts, the total sizes[ptr] value wraps around due to modulo 2^32 arithmetic. This wrapped total is then used to determine the size of the samples[channel] buffer, leading to an undersized buffer. Subsequent write operations in the generic unpack deep pointers function can then overrun this buffer.

Recommendations Update to OpenEXR version 3.2.6 or later. Update to OpenEXR version 3.3.8 or later. Update to OpenEXR version 3.4.6 or later.