CVE-2026-34544: CWE-190: Integer Overflow or Wraparound in AcademySoftwareFoundation openexr
A high-severity integer overflow vulnerability exists in AcademySoftwareFoundation's openexr library versions 3. 4. 0 up to but not including 3. 4. 8. This flaw occurs when processing crafted B44 or B44A EXR image files, leading to an out-of-bounds write during decoding. The issue can cause application crashes or heap corruption depending on memory layout. The vulnerability has been addressed in version 3. 4. 8.
AI Analysis
Technical Summary
OpenEXR, a reference implementation for the EXR image format used in motion picture industry applications, contains an integer overflow or wraparound vulnerability (CWE-190) that leads to an out-of-bounds write (CWE-787) when decoding specially crafted B44 or B44A EXR files via the exr_decoding_run() function. This affects versions from 3.4.0 up to but not including 3.4.8. Exploitation can cause immediate crashes or memory corruption. The vulnerability is tracked as CVE-2026-34544 with a CVSS 4.0 score of 8.4 (high severity).
Potential Impact
Exploitation of this vulnerability can cause an application using the affected openexr versions to crash or experience heap corruption, potentially leading to denial of service or other unpredictable behavior. There are no known exploits in the wild as of the published date.
Mitigation Recommendations
Upgrade to openexr version 3.4.8 or later, where this vulnerability has been patched. No other mitigation steps are indicated.
CVE-2026-34544: CWE-190: Integer Overflow or Wraparound in AcademySoftwareFoundation openexr
Description
A high-severity integer overflow vulnerability exists in AcademySoftwareFoundation's openexr library versions 3. 4. 0 up to but not including 3. 4. 8. This flaw occurs when processing crafted B44 or B44A EXR image files, leading to an out-of-bounds write during decoding. The issue can cause application crashes or heap corruption depending on memory layout. The vulnerability has been addressed in version 3. 4. 8.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenEXR, a reference implementation for the EXR image format used in motion picture industry applications, contains an integer overflow or wraparound vulnerability (CWE-190) that leads to an out-of-bounds write (CWE-787) when decoding specially crafted B44 or B44A EXR files via the exr_decoding_run() function. This affects versions from 3.4.0 up to but not including 3.4.8. Exploitation can cause immediate crashes or memory corruption. The vulnerability is tracked as CVE-2026-34544 with a CVSS 4.0 score of 8.4 (high severity).
Potential Impact
Exploitation of this vulnerability can cause an application using the affected openexr versions to crash or experience heap corruption, potentially leading to denial of service or other unpredictable behavior. There are no known exploits in the wild as of the published date.
Mitigation Recommendations
Upgrade to openexr version 3.4.8 or later, where this vulnerability has been patched. No other mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-30T16:31:39.264Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69cd8944e6bfc5ba1dfc32ef
Added to database: 4/1/2026, 9:08:20 PM
Last enriched: 4/9/2026, 11:59:55 PM
Last updated: 5/17/2026, 12:37:44 AM
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.