PT-2026-30658 · Openexr · Openexr

Pwn2Woot · Published 2026-04-06 · Updated 2026-05-11 · CVE-2026-34379

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.2.0 through 3.2.6, version 3.3.9, and version 3.4.9

Description A memory write issue exists in the LossyDctDecoder execute() function within src/lib/OpenEXRCore/internal dwa decoder.h:749 when decoding DWA or DWAB-compressed EXR files with FLOAT-type channels. The decoder casts an unaligned uint8 t * row pointer to float * and writes through it, leading to undefined behavior on architectures enforcing alignment (ARM, RISC-V, etc.). While silently tolerated on x86, it remains exploitable through compiler optimizations.

Recommendations Update to OpenEXR version 3.2.7 or later. Update to OpenEXR version 3.3.9 or later. Update to OpenEXR version 3.4.9 or later.

Fix

Incorrect Type Conversion or Cast

Memory Corruption

Type Confusion

Weakness Enumeration

CWE-704

CWE-787

CWE-843

Related Identifiers

CVE-2026-34379

OESA-2026-1840

OESA-2026-1841

OESA-2026-1842

OESA-2026-1843

OPENSUSE-SU-2026:10505-1

OPENSUSE-SU-2026:20605-1

Affected Products

Openexr

References · 42

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-w88v-vqhq-5p24 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34379 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1841 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34379 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34379 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1843 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1840 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20605-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34589 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34380 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34379 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34379 · Security Note