CVE-2026-40250

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.4.0 through 3.4.9 OpenEXR versions 3.3.0 through 3.3.9 OpenEXR versions 3.2.0 through 3.2.7

Description An integer overflow occurs in the reference implementation of the EXR image storage format. The issue exists in internal dwa compressor.h:1040 where the calculation chan->width * chan->bytes per element is performed using int32 arithmetic without a (size t) cast.

Recommendations Update versions 3.4.0 through 3.4.9 to 3.4.10. Update versions 3.3.0 through 3.3.9 to 3.3.10. Update versions 3.2.0 through 3.2.7 to 3.2.8.