OpenEXR, used for EXR image format decoding, has a heap-based buffer overflow vulnerability (CWE-122) in versions >=3.4.0 and <3.4.7. When decoding a malicious .exr file with HTJ2K compression and a channel width of 32768, the software writes beyond the allocated heap buffer by 2 or 4 bytes per overflow iteration for each pixel past the overflow point. This memory corruption can enable remote code execution on affected systems. The vulnerability is tracked as CVE-2026-34545 and has a CVSS 4.0 base score of 8.4 (high severity). The flaw is fixed in version 3.4.7.

Successful exploitation allows an attacker to execute arbitrary code remotely by supplying a specially crafted .exr image file. The heap overflow writes controlled data beyond the buffer, potentially compromising the affected application and system. No known exploits in the wild have been reported at this time.

Upgrade openexr to version 3.4.7 or later, where this vulnerability is patched. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the vendor advisory from Red Hat.