OpenEXR, a reference implementation for the EXR image file format used in motion picture industry, contains a vulnerability (CVE-2026-34543) in versions from 3.4.0 to before 3.4.8 where uninitialized heap memory may be exposed via decoded pixel data. This results in potential information disclosure when processing a crafted malicious EXR file. The vulnerability is classified under CWE-908 (Use of Uninitialized Resource) and has a CVSS 4.0 score of 8.7, indicating high severity. The issue is resolved in version 3.4.8.

An attacker can cause sensitive information from heap memory to be leaked by supplying a malicious EXR file that triggers the use of uninitialized memory during decoding. This can lead to unauthorized disclosure of potentially sensitive data contained in heap memory. No user interaction is required beyond opening or processing the malicious file. There are no known exploits in the wild at this time.

Upgrade openexr to version 3.4.8 or later, where this vulnerability has been patched. Until the update is applied, avoid processing untrusted or unauthenticated EXR files to reduce risk of information disclosure.