CVE-2026-34378

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overflow in generic_unpack(). By setting dataWindow.min.x to a large negative value, OpenEXRCore computes an enormous image width, which is later used in a signed integer multiplication that overflows, causing the process to terminate with SIGILL via UBSan. This vulnerability is fixed in 3.4.9.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9	Product Release Notes
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v76p-4qvv-vh4g	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) OpenEXR proporciona la especificación e implementación de referencia del formato de archivo EXR, un formato de almacenamiento de imágenes para la industria cinematográfica. Desde la versión 3.4.0 hasta antes de la 3.4.9, una falta de verificación de límites en el atributo dataWindow en las cabeceras de los archivos EXR permite a un atacante activar un desbordamiento de entero con signo en generic_unpack(). Al establecer dataWindow.min.x a un valor negativo grande, OpenEXRCore calcula un ancho de imagen enorme, que luego se utiliza en una multiplicación de enteros con signo que se desborda, lo que provoca que el proceso termine con SIGILL a través de UBSan. Esta vulnerabilidad se corrige en la versión 3.4.9.

Information

Published : 2026-04-06 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34378

Mitre link : CVE-2026-34378

CVE.ORG link : CVE-2026-34378

JSON object : View

Products Affected

openexr

openexr

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-34378", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34378", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:33:07.546592Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "AcademySoftwareFoundation", "product": "openexr", "versions": [{"status": "affected", "version": ">= 3.4.0, < 3.4.9"}]}]}], "published": "2026-04-06T16:16:35.057", "references": [{"url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v76p-4qvv-vh4g", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overflow in generic_unpack(). By setting dataWindow.min.x to a large negative value, OpenEXRCore computes an enormous image width, which is later used in a signed integer multiplication that overflows, causing the process to terminate with SIGILL via UBSan. This vulnerability is fixed in 3.4.9."}, {"lang": "es", "value": "OpenEXR proporciona la especificaci\u00f3n e implementaci\u00f3n de referencia del formato de archivo EXR, un formato de almacenamiento de im\u00e1genes para la industria cinematogr\u00e1fica. Desde la versi\u00f3n 3.4.0 hasta antes de la 3.4.9, una falta de verificaci\u00f3n de l\u00edmites en el atributo dataWindow en las cabeceras de los archivos EXR permite a un atacante activar un desbordamiento de entero con signo en generic_unpack(). Al establecer dataWindow.min.x a un valor negativo grande, OpenEXRCore calcula un ancho de imagen enorme, que luego se utiliza en una multiplicaci\u00f3n de enteros con signo que se desborda, lo que provoca que el proceso termine con SIGILL a trav\u00e9s de UBSan. Esta vulnerabilidad se corrige en la versi\u00f3n 3.4.9."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94F2D271-636B-4E9E-A04B-40E635A59117", "versionEndExcluding": "3.4.9", "versionStartIncluding": "3.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}