PT-2026-30657 · Academy Software Foundation · Openexr

Pwn2Woot · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-34378

Mitre

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overflow in generic unpack(). By setting dataWindow.min.x to a large negative value, OpenEXRCore computes an enormous image width, which is later used in a signed integer multiplication that overflows, causing the process to terminate with SIGILL via UBSan. This vulnerability is fixed in 3.4.9.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-34378

Affected Products

Openexr

References · 2

• 🔥 https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v76p-4qvv-vh4g · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34378 · Security Note