The vulnerability CVE-2026-40244 in openexr arises from an integer overflow in the calculation of image dimensions within the internal_dwa_compressor.h source file. Specifically, the product of width and height is computed using int32 arithmetic without casting to size_t, which can cause overflow and potentially lead to memory corruption or other unintended behavior. This issue affects multiple versions of openexr prior to 3.2.8, 3.3.10, and 3.4.10, where the fix has been applied. The vulnerability is categorized under CWE-190 (Integer Overflow or Wraparound) and carries a high CVSS 4.0 score of 8.4, indicating significant impact if exploited. No vendor advisory or explicit patch link is provided, so patch status should be verified with the vendor.

The integer overflow can lead to incorrect memory allocation or buffer size calculations, potentially causing memory corruption or crashes when processing specially crafted EXR image files. This may result in denial of service or other undefined behavior. The CVSS score of 8.4 reflects high impact, including high confidentiality, integrity, and availability impacts. There are no reports of known exploits in the wild at this time.

Fixed versions of openexr are available: 3.2.8, 3.3.10, and 3.4.10. Users should upgrade to these or later versions to remediate the vulnerability. Since no official vendor advisory or patch link is provided, users should verify the availability and applicability of patches from the AcademySoftwareFoundation or the openexr project repositories. Until patched, avoid processing untrusted EXR files to reduce risk.