Out-of-bounds write in OpenEXR - CVE-2026-34544

Vulnerability identifier: #VU125327

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-34544

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service and corrupt memory.

The vulnerability exists due to out-of-bounds write in uncompress_b44_impl() in internal_b44.c when decoding a crafted B44 or B44A EXR file via exr_decoding_run(). A remote attacker can supply a specially crafted EXR file to cause a denial of service and corrupt memory.

User interaction is required to open or decode the crafted file.

OpenEXR
Anolis OS
Fedora
mingw-openexr
OpenEXR
OpenEXR-devel
OpenEXR-libs
OpenEXR-doc
usd

Install security update from vendor's website.

OpenEXR - addressed in versions 3.2.7, 3.3.9, 3.4.8
mingw-openexr - addressed in versions 3.4.8-1.fc44, 3.4.9-1.fc44
OpenEXR - update to 3.4.10-1
OpenEXR-devel - update to 3.4.10-1
OpenEXR-libs - update to 3.4.10-1
OpenEXR-doc - update to 3.4.10-1
usd - addressed in versions 26.03-2.fc44, 26.03-2.fc45, 26.03-3.fc44

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-h762-rhv3-h25v

• Multiple vulnerabilities in OpenEXR
• Fedora 44 update for mingw-openexr
• Fedora 44 update for mingw-openexr
• Fedora 45 update for usd
• Fedora 44 update for usd
• Fedora 44 update for usd
• Anolis OS update for OpenEXR