CVE-2026-34588

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.1.0 through 3.2.6, versions prior to 3.3.9, and versions prior to 3.4.9

Description OpenEXR, an image storage format used in the motion picture industry, contains a flaw in the internal exr undo piz() function. Specifically, the function uses signed 32-bit arithmetic to advance a wavelet pointer, which can lead to integer overflow and wrap-around when processing a crafted EXR file. This results in out-of-bounds reads and writes during wavelet decoding, as the function operates in place.

Recommendations Update OpenEXR to version 3.2.7 or later. Update OpenEXR to version 3.3.9 or later. Update OpenEXR to version 3.4.9 or later.