PT-2026-29621 · Openexr · Openexr

Nicoppida · Publicado 2026-04-01 · Atualizado 2026-06-01 · CVE-2026-34544

Positive Technologies (AI Summary) · Pt

CVSS v4.0

8.4

Alta

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEXR versões 3.4.0 através de 3.4.7

Description OpenEXR, um formato de armazenamento de imagens usado na indústria cinematográfica, contém uma falha onde um arquivo EXR especialmente criado (formato B44 ou B44A) pode levar a uma escrita fora dos limites durante a decodificação através da função exr decoding run(). Isso pode resultar em uma falha ou, potencialmente, corrupção de alocações de heap.

Recommendations Atualize para a versão 3.4.8 ou posterior do OpenEXR.

Correção

Memory Corruption

Integer Overflow

Enumeração de Fraquezas

CWE-787

CWE-190

Identificadores relacionados

CVE-2026-34544

ECHO-FD63-872C-58AA

GHSA-H762-RHV3-H25V

OPENSUSE-SU-2026:10505-1

Produtos afetados

Openexr

Referências · 24

• https://github.com/AcademySoftwareFoundation/openexr/commit/35e7aa35e22c1975606be86e859f31cc1fc598ee · Correção
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-h762-rhv3-h25v · Aviso do Fabricante
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8 · Nota
• https://github.com/AcademySoftwareFoundation/openexr · Nota
• https://suse.com/security/cve/CVE-2026-34379 · Nota
• https://suse.com/security/cve/CVE-2026-34380 · Nota
• https://suse.com/security/cve/CVE-2026-34589 · Nota
• https://osv.dev/vulnerability/BELL-CVE-2026-34544 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-h762-rhv3-h25v · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-34545 · Nota
• https://ubuntu.com/security/CVE-2026-34544 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34544 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-34378 · Nota
• https://suse.com/security/cve/CVE-2026-34543 · Nota
• https://suse.com/security/cve/CVE-2026-34588 · Nota