CVE-2026-34379

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.2.0 through 3.2.6, version 3.3.9, and version 3.4.9

Description A memory write issue exists in the LossyDctDecoder execute() function within src/lib/OpenEXRCore/internal dwa decoder.h:749 when decoding DWA or DWAB-compressed EXR files with FLOAT-type channels. The decoder casts an unaligned uint8 t * row pointer to float * and writes through it, leading to undefined behavior on architectures enforcing alignment (ARM, RISC-V, etc.). While silently tolerated on x86, it remains exploitable through compiler optimizations.

Recommendations Update to OpenEXR version 3.2.7 or later. Update to OpenEXR version 3.3.9 or later. Update to OpenEXR version 3.4.9 or later.