OpenEXR versions 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9 contain a signed integer overflow in the undo_pxr24_impl() function located in src/lib/OpenEXRCore/internal_pxr24.c at line 377. The multiplication expression (uint64_t)(w * 3) is computed as a signed 32-bit integer before casting, which can cause two's-complement wraparound for large values of w. This wraparound may cause an incorrect bounds check to pass, allowing the decoding loop to write pixel data beyond the allocated buffer, resulting in a potential out-of-bounds write vulnerability. This vulnerability is tracked as CVE-2026-34380 and is associated with CWE-190 (Integer Overflow) and CWE-787 (Out-of-bounds Write). The issue is fixed in versions 3.2.7, 3.3.9, and 3.4.9.

The vulnerability can lead to out-of-bounds memory writes during image decoding, which may cause application crashes or potentially enable limited code execution or data corruption. The CVSS score of 5.9 reflects a medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. There are no known exploits in the wild at this time.

This vulnerability is fixed in openexr versions 3.2.7, 3.3.9, and 3.4.9. Users should upgrade to one of these fixed versions or later to remediate the issue. Patch status is not explicitly confirmed by a vendor advisory in the provided data; therefore, users should verify the availability of official patches or updates from the AcademySoftwareFoundation or the openexr project. Until patched, avoid processing untrusted EXR files with affected versions to reduce risk.