CVE-2026-34589 Details
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, the DWA lossy decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. For a large enough width, the calculation overflows and later decoder stores operate on a wrapped pointer outside the allocated rowBlock backing store. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
A heap out-of-bounds write vulnerability has been identified in the DWA lossy decoder of OpenEXR versions 3.2.0 prior to 3.2.7, 3.3.0 prior to 3.3.9, and 3.4.0 prior to 3.4.9. The vulnerability arises because the decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. When the width is sufficiently large, this calculation can overflow, causing the decoder to operate on a wrapped pointer that points outside the allocated rowBlock backing store. This issue is reachable through the public decoder path and can be reproduced with a crafted scanline DWAA file using the 'exrcheck' tool.
Users should upgrade to OpenEXR versions 3.2.7, 3.3.9, or 3.4.9, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-34589 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2455411 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34589.json | redhat-SADP | |
| https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.7 | [email protected] | ProductRelease Notes |
| https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.9 | [email protected] | ProductRelease Notes |
| https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9 | [email protected] | ProductRelease Notes |
| https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-p8xc-w3q4-h64x | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | redhat-SADP |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openexr openexr | >= 3.2.0, < 3.2.7 >= 3.3.0, < 3.3.9 >= 3.4.0, < 3.4.9 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | CVE Modified | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |