CVE-2026-34378 Details
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overflow in generic_unpack(). By setting dataWindow.min.x to a large negative value, OpenEXRCore computes an enormous image width, which is later used in a signed integer multiplication that overflows, causing the process to terminate with SIGILL via UBSan. This vulnerability is fixed in 3.4.9.
A signed integer overflow vulnerability has been identified in OpenEXR versions 3.4.0 prior to 3.4.9. The issue arises from a missing bounds check on the dataWindow attribute in EXR file headers. This flaw allows an attacker to craft an EXR file that, when processed, triggers the overflow. By setting dataWindow.min.x to a large negative value, OpenEXRCore calculates an excessively wide image, which leads to the overflow during a signed integer multiplication. The resulting crash is caught by Undefined Behavior Sanitizer, indicating the presence of the vulnerability.
Users should update to OpenEXR version 3.4.9 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9 | [email protected] | ProductRelease Notes |
| https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v76p-4qvv-vh4g | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openexr openexr | >= 3.4.0, < 3.4.9 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | CVE Modified | [email protected] |
| Apr 6, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |
| Apr 6, 2026 | CVE Modified | CISA-ADP |