CVE-2026-34588: CWE-125: Out-of-bounds Read in AcademySoftwareFoundation openexr
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
AI Analysis
Technical Summary
The openexr library, used for handling the EXR image format, contains an out-of-bounds read and write vulnerability in the internal_exr_undo_piz() function. This function advances a working wavelet pointer using signed 32-bit arithmetic involving int variables nx, ny, and wcount. Crafted EXR files can trigger integer overflow and pointer wraparound, causing subsequent channel decoding to access invalid memory locations. The vulnerability affects multiple version branches prior to 3.2.7, 3.3.9, and 3.4.9, where the issue has been fixed. The CVSS 4.0 score is 8.6, indicating high severity with local attack vector and no required privileges or user interaction.
Potential Impact
Successful exploitation can cause out-of-bounds memory reads and writes during image decoding, potentially leading to memory corruption, application crashes, or other undefined behavior. The vulnerability is exploitable locally without privileges or user interaction, but requires a crafted EXR file. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in openexr versions 3.2.7, 3.3.9, and 3.4.9. Users should upgrade to one of these fixed versions to remediate the issue. Patch status is not explicitly confirmed beyond these version updates; therefore, verify with the vendor advisory for the latest remediation guidance.
CVE-2026-34588: CWE-125: Out-of-bounds Read in AcademySoftwareFoundation openexr
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The openexr library, used for handling the EXR image format, contains an out-of-bounds read and write vulnerability in the internal_exr_undo_piz() function. This function advances a working wavelet pointer using signed 32-bit arithmetic involving int variables nx, ny, and wcount. Crafted EXR files can trigger integer overflow and pointer wraparound, causing subsequent channel decoding to access invalid memory locations. The vulnerability affects multiple version branches prior to 3.2.7, 3.3.9, and 3.4.9, where the issue has been fixed. The CVSS 4.0 score is 8.6, indicating high severity with local attack vector and no required privileges or user interaction.
Potential Impact
Successful exploitation can cause out-of-bounds memory reads and writes during image decoding, potentially leading to memory corruption, application crashes, or other undefined behavior. The vulnerability is exploitable locally without privileges or user interaction, but requires a crafted EXR file. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in openexr versions 3.2.7, 3.3.9, and 3.4.9. Users should upgrade to one of these fixed versions to remediate the issue. Patch status is not explicitly confirmed beyond these version updates; therefore, verify with the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-30T16:56:30.999Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d47ddc0a160ebd9234c83a
Added to database: 4/7/2026, 3:45:32 AM
Last enriched: 4/7/2026, 4:00:34 AM
Last updated: 4/7/2026, 5:22:57 AM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.