PT-2026-29620 · Openexr · Openexr

Cary Phillips · Published 2026-04-01 · Updated 2026-06-01 · CVE-2026-34543

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.4.0 through 3.4.7

Description OpenEXR, an image storage format used in the motion picture industry, may disclose sensitive information from heap memory through decoded pixel data. This information disclosure occurs when processing a malicious EXR file under default settings, requiring no user interaction.

Recommendations Update to version 3.4.8 or later.

Exploit

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2026-34543

ECHO-DD0B-5DB3-5ACE

GHSA-VC68-257W-M432

OPENSUSE-SU-2026:10505-1

Affected Products

Openexr

References · 24

• 🔥 https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-vc68-257w-m432 · Exploit
• https://github.com/AcademySoftwareFoundation/openexr/commit/5f6d0aaa9e43802917af7db90f181e88e083d3b8 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34543 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-34543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34543 · Security Note
• https://osv.dev/vulnerability/GHSA-vc68-257w-m432 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34543 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-34543 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34543 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34543 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10505-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34543 · Vendor Advisory
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8 · Note
• https://github.com/AcademySoftwareFoundation/openexr · Note
• https://suse.com/security/cve/CVE-2026-34379 · Note