Integer overflow in OpenEXR - CVE-2026-34588

Vulnerability identifier: #VU125329

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-34588

CWE-ID: CWE-190

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to read and write out-of-bounds memory.

The vulnerability exists due to integer overflow in internal_exr_undo_piz() in the PIZ decoder when parsing a crafted EXR file. A remote attacker can supply a specially crafted EXR file to read and write out-of-bounds memory.

The issue occurs during PIZ decompression because signed 32-bit arithmetic can wrap while advancing the working wavelet pointer, causing the next channel to decode from an incorrect address.

OpenEXR
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openexr (Ubuntu package)
OpenEXR (Red Hat package)
OpenEXR-debuginfo
OpenEXR-libs
OpenEXR-devel
OpenEXR-debugsource
OpenEXR
mingw-openexr
OpenEXR-doc
usd
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Ubuntu
Anolis OS
openEuler
Fedora

Install security update from vendor's website.

OpenEXR - addressed in versions 3.2.7, 3.3.9, 3.4.9
openexr (Ubuntu package) - addressed in versions 2.2.0-10ubuntu2.6+esm4, 2.2.0-11.1ubuntu1.9+esm1, 2.3.0-6ubuntu0.5+esm2, 2.5.7-1ubuntu0.1~esm2, 3.1.5-5.1ubuntu0.1~esm1, 3.1.13-2ubuntu0.26.04.1~esm1
OpenEXR (Red Hat package) - addressed in versions 3.1.1-2.el9_0.3, 3.1.1-2.el9_2.3, 3.1.1-3.el9_6.2, 3.1.10-8.el10_0.2, 3.1.10-8.el10_1.2
OpenEXR-debuginfo - update to 3.1.11-7
OpenEXR-libs - update to 3.1.11-7
OpenEXR-devel - update to 3.1.11-7
OpenEXR-debugsource - update to 3.1.11-7
OpenEXR - update to 3.1.11-7
mingw-openexr - addressed in versions 3.3.9-1.fc42, 3.3.9-1.fc43
OpenEXR-doc - addressed in versions 3.4.4-4, 3.4.10-1
OpenEXR-libs - addressed in versions 3.4.4-4, 3.4.10-1
OpenEXR-devel - addressed in versions 3.4.4-4, 3.4.10-1
OpenEXR - addressed in versions 3.4.4-4, 3.4.10-1
usd - addressed in versions 25.08-20.fc43, 26.03-3.fc44, 26.03-3.fc45

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf
• https://github.com/advisories/GHSA-588r-cr5c-w6hf

• Multiple vulnerabilities in OpenEXR
• Fedora 42 update for mingw-openexr
• Fedora 43 update for mingw-openexr
• Fedora 45 update for usd
• Fedora 44 update for usd
• Fedora 43 update for usd
• openEuler 24.03 LTS SP3 update for OpenEXR
• openEuler 24.03 LTS SP2 update for OpenEXR
• openEuler 24.03 LTS SP1 update for OpenEXR
• openEuler 24.03 LTS update for OpenEXR
• Anolis OS update for OpenEXR
• Ubuntu update for openexr
• Red Hat Enterprise Linux 10 update for openexr
• Red Hat Enterprise Linux 10 update for openexr
• Red Hat Enterprise Linux 9 update for openexr
• Red Hat Enterprise Linux 9 update for openexr
• Red Hat Enterprise Linux 9 update for openexr
• Anolis OS update for OpenEXR