Type conversion in OpenEXR - CVE-2026-34379

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125332

Type conversion in OpenEXR - CVE-2026-34379

Published: April 8, 2026


Vulnerability identifier: #VU125332
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-34379
CWE-ID: CWE-704
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect type conversion or cast in LossyDctDecoder_execute() when decoding a DWA- or DWAB-compressed EXR file containing a FLOAT-type channel. A remote attacker can supply a specially crafted EXR file to cause a denial of service.

User interaction is required to open or process the crafted file.


Affected software

OpenEXR
Anolis OS
openEuler
Fedora
OpenEXR-debuginfo
OpenEXR
OpenEXR-libs
OpenEXR-devel
OpenEXR-debugsource
mingw-openexr
OpenEXR-doc
usd

How to mitigate CVE-2026-34379

Install security update from vendor's website.

OpenEXR - addressed in versions 3.2.7, 3.3.9, 3.4.9
OpenEXR-debuginfo - update to 3.1.11-7
OpenEXR - update to 3.1.11-7
OpenEXR-libs - update to 3.1.11-7
OpenEXR-devel - update to 3.1.11-7
OpenEXR-debugsource - update to 3.1.11-7
mingw-openexr - addressed in versions 3.3.9-1.fc42, 3.3.9-1.fc43
OpenEXR - update to 3.4.10-1
OpenEXR-devel - update to 3.4.10-1
OpenEXR-libs - update to 3.4.10-1
OpenEXR-doc - update to 3.4.10-1
usd - addressed in versions 25.08-20.fc43, 26.03-3.fc44, 26.03-3.fc45

External References

Related Security Bulletins