The vulnerability CVE-2026-40250 in openexr involves an integer overflow or wraparound in the calculation of `chan->width * chan->bytes_per_element` within the internal_dwa_compressor.h source file. This multiplication is done using 32-bit integer arithmetic without casting to a larger type such as size_t, which can cause overflow if the product exceeds the maximum value representable by int32. This flaw affects multiple versions of openexr prior to the fixed releases 3.2.8, 3.3.10, and 3.4.10. The issue is similar to previously fixed overflow bugs in other decoders of the same project. The vulnerability has a CVSS 4.0 score of 8.4, indicating high severity, with local attack vector, low complexity, no privileges required, and user interaction needed. The impact includes high confidentiality, integrity, and availability consequences.

Successful exploitation of this integer overflow could lead to memory corruption or other undefined behavior when processing specially crafted EXR image files, potentially resulting in denial of service or other impacts on confidentiality, integrity, and availability. The vulnerability requires local access and user interaction, limiting remote exploitation. No known exploits are reported in the wild at this time.

A fix for this vulnerability is included in openexr versions 3.2.8, 3.3.10, and 3.4.10. Users and organizations should upgrade to one of these fixed versions to remediate the issue. Since no official patch links or vendor advisories are provided, verify the upgrade status with the AcademySoftwareFoundation's official openexr project resources. Patch status is not yet confirmed beyond the version fixes mentioned; check the vendor advisory for current remediation guidance.