The openexr library, used for the EXR image format in motion picture industry applications, contains an integer overflow vulnerability (CWE-190) in versions 3.2.0 to 3.2.7, 3.3.0 to 3.3.9, and 3.4.0 to 3.4.9. Specifically, in internal_dwa_compressor.h at line 1722, the multiplication of curc->width and curc->height is performed using int32 arithmetic without casting to size_t, which can cause an integer overflow or wraparound. This flaw was overlooked in a previous batch fix (CVE-2026-34589) but has been corrected in versions 3.2.8, 3.3.10, and 3.4.10. The vulnerability has a CVSS 4.0 score of 8.4 (high severity), indicating significant impact potential if exploited. No known exploits are reported in the wild. The Red Hat advisory linked provides further details but does not explicitly state patch availability beyond the version fixes mentioned.

Successful exploitation of this integer overflow could lead to memory corruption or other undefined behavior due to incorrect size calculations during image compression. This may result in denial of service or potentially code execution depending on how the corrupted data is handled. The CVSS 4.0 score of 8.4 reflects high impact with local attack vector, low attack complexity, no privileges required, user interaction needed, and high impacts on confidentiality, integrity, and availability.

Fixed versions 3.2.8, 3.3.10, and 3.4.10 address this vulnerability by correcting the integer arithmetic to prevent overflow. Users should upgrade to these or later versions to remediate the issue. The Red Hat advisory does not indicate any temporary mitigations or that no action is required. Patch status is confirmed by the version fixes stated in the description. No cloud service remediation applies as this is a library. Check the vendor advisory for the latest updates.