CVE-2026-34588: CWE-125: Out-of-bounds Read in AcademySoftwareFoundation openexr
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
AI Analysis
Technical Summary
The openexr library, used for the EXR image format in motion picture workflows, contains an out-of-bounds read and write vulnerability in the internal_exr_undo_piz() function. This function advances a wavelet pointer using signed 32-bit arithmetic involving int variables nx, ny, and wcount. Crafted EXR files can cause integer overflow and pointer wraparound, leading to decoding from incorrect memory addresses. This results in both out-of-bounds reads and writes during wavelet decoding. Affected versions include 3.1.0 up to but not including 3.2.7, 3.3.9, and 3.4.9. The vulnerability is addressed in versions 3.2.7, 3.3.9, and 3.4.9.
Potential Impact
Exploitation of this vulnerability can cause out-of-bounds memory access, potentially leading to memory corruption, application crashes, or other undefined behavior. The CVSS 4.0 base score is 8.6 (high severity), indicating significant impact on confidentiality, integrity, and availability when exploited locally without user interaction. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in openexr versions 3.2.7, 3.3.9, and 3.4.9. Users should upgrade to one of these fixed versions to remediate the issue. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified.
CVE-2026-34588: CWE-125: Out-of-bounds Read in AcademySoftwareFoundation openexr
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The openexr library, used for the EXR image format in motion picture workflows, contains an out-of-bounds read and write vulnerability in the internal_exr_undo_piz() function. This function advances a wavelet pointer using signed 32-bit arithmetic involving int variables nx, ny, and wcount. Crafted EXR files can cause integer overflow and pointer wraparound, leading to decoding from incorrect memory addresses. This results in both out-of-bounds reads and writes during wavelet decoding. Affected versions include 3.1.0 up to but not including 3.2.7, 3.3.9, and 3.4.9. The vulnerability is addressed in versions 3.2.7, 3.3.9, and 3.4.9.
Potential Impact
Exploitation of this vulnerability can cause out-of-bounds memory access, potentially leading to memory corruption, application crashes, or other undefined behavior. The CVSS 4.0 base score is 8.6 (high severity), indicating significant impact on confidentiality, integrity, and availability when exploited locally without user interaction. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in openexr versions 3.2.7, 3.3.9, and 3.4.9. Users should upgrade to one of these fixed versions to remediate the issue. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-30T16:56:30.999Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d47ddc0a160ebd9234c83a
Added to database: 4/7/2026, 3:45:32 AM
Last enriched: 5/14/2026, 2:25:41 AM
Last updated: 5/22/2026, 3:08:16 PM
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.