PT-2026-30659 · Industrial Light & Magic+2 · Openexr+2
Pwn2Woot
·
Published
2026-04-06
·
Updated
2026-05-11
·
CVE-2026-34380
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
OpenEXR versions 3.2.0 through 3.2.6, 3.3.9, and 3.4.9
Description
A signed integer overflow exists in the
undo pxr24 impl() function within the OpenEXR library. The expression (uint64 t)(w * 3) calculates w * 3 as a signed 32-bit integer before converting it to an unsigned 64-bit integer. When w is a large value, this multiplication can lead to undefined behavior. In tested builds, two's-complement wraparound commonly occurs, and for specific values of w, the wrapped result is a small positive integer. This can cause a subsequent bounds check to pass incorrectly, allowing the decoding loop to write pixel data beyond the allocated output buffer.Recommendations
Update to OpenEXR version 3.2.7, 3.3.9, or 3.4.9.
Fix
Integer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Openexr
Ubuntu