{"id":"CVE-2026-27622","title":"OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write","summary":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned in…","severity":"high","cvss":8.4,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-787","CWE-190"],"vendor":"AcademySoftwareFoundation","product":"openexr","affected":["openexr >= 2.3.0, < 3.2.6","openexr >= 3.3.0, < 3.3.8","openexr >= 3.4.0, < 3.4.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-03-10T00:00:00+00:00"},"published":"2026-03-03","updated":"2026-09-09","sourceUpdated":"2026-09-09T12:04:51.973Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-27622","references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963","label":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27622.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-27622"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444251"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27622"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27622"},{"url":"https://access.redhat.com/errata/RHSA-2026:7678"},{"url":"https://access.redhat.com/errata/RHSA-2026:7682"},{"url":"https://access.redhat.com/errata/RHSA-2026:8863"},{"url":"https://access.redhat.com/errata/RHSA-2026:12340"},{"url":"https://access.redhat.com/errata/RHSA-2026:12341"},{"url":"https://access.redhat.com/errata/RHSA-2026:12339"},{"url":"https://access.redhat.com/errata/RHSA-2026:12338"},{"url":"https://access.redhat.com/errata/RHSA-2026:8870"},{"url":"https://access.redhat.com/errata/RHSA-2026:8869"},{"url":"https://access.redhat.com/errata/RHSA-2026:8871"},{"url":"https://access.redhat.com/errata/RHSA-2026:8872"},{"url":"https://access.redhat.com/errata/RHSA-2026:8888"},{"url":"https://access.redhat.com/errata/RHSA-2026:16008"},{"url":"https://access.redhat.com/errata/RHSA-2026:16030"},{"url":"https://access.redhat.com/errata/RHSA-2026:16009"},{"url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"url":"https://github.com/AcademySoftwareFoundation/openexr"}],"tags":["cve.org","csaf","vex","red-hat","osv","pip"],"epss":0.00201,"epssPercentile":0.10278,"aliases":["GHSA-cr4v-6jm6-4963","PYSEC-2026-2846"],"ecosystem":"pip","patched":["enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_2","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_eus_extension_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_e4s_v_8_6","enterprise_linux_appstream_tus_v_8_6","enterprise_linux_appstream_e4s_v_8_8","enterprise_linux_appstream_tus_v_8_8","enterprise_linux_appstream_e4s_v_9_0","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","codeready_linux_builder_eus_v_9_4","codeready_linux_builder_eus_v_9_6","enterprise_linux_codeready_linux_builder_v_9","ai_inference_server 3.3"],"scores":{"cna":8.4,"vendor":7.4},"ingestedAt":"2026-07-13T18:57:56.829Z","slug":"CVE-2026-27622","body":"## Overview\n\nOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.\n\n## Affected\n\n- `openexr >= 2.3.0, < 3.2.6`\n- `openexr >= 3.3.0, < 3.3.8`\n- `openexr >= 3.4.0, < 3.4.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-27622)\n\nAffected packages:\n\n- `openexr >= 2.3.0, < 3.2.6`\n- `openexr >= 3.3.0, < 3.3.8`\n- `openexr >= 3.4.0, < 3.4.6`\n\nPatched in:\n\n- `openexr 3.2.6`\n- `openexr 3.3.8`\n- `openexr 3.4.6`\n\nSource: https://osv.dev/vulnerability/GHSA-cr4v-6jm6-4963\n\n## Vendor advisories\n\n- **RHSA-2026:7678** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-04-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:7678)\n- **RHSA-2026:7682** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-04-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:7682)\n- **RHSA-2026:8863** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8863)\n- **RHSA-2026:12340** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12340)\n- **RHSA-2026:12341** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12341)\n- **RHSA-2026:12339** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12339)\n- **RHSA-2026:12338** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12338)\n- **RHSA-2026:8870** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.0) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8870)\n- **RHSA-2026:8869** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8869)\n- **RHSA-2026:8871** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat CodeReady Linux Builder EUS (v.9.4) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8871)\n- **RHSA-2026:8872** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8872)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27622.json)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201484,"id":"CVE-2026-27622","ts":1789399510296,"field":"cvss","old":"7.4","new":"8.4"},{"seq":200218,"id":"CVE-2026-27622","ts":1789397078794,"field":"cvss","old":"8.4","new":"7.4"},{"seq":198142,"id":"CVE-2026-27622","ts":1789391727629,"field":"cvss","old":"7.4","new":"8.4"},{"seq":195935,"id":"CVE-2026-27622","ts":1789383392921,"field":"cvss","old":"8.4","new":"7.4"},{"seq":194864,"id":"CVE-2026-27622","ts":1789380298738,"field":"cvss","old":"7.4","new":"8.4"},{"seq":193651,"id":"CVE-2026-27622","ts":1789378261738,"field":"cvss","old":"8.4","new":"7.4"},{"seq":192438,"id":"CVE-2026-27622","ts":1789376228589,"field":"cvss","old":"7.4","new":"8.4"},{"seq":191225,"id":"CVE-2026-27622","ts":1789373119324,"field":"cvss","old":"8.4","new":"7.4"},{"seq":190010,"id":"CVE-2026-27622","ts":1789369119641,"field":"cvss","old":"7.4","new":"8.4"},{"seq":188797,"id":"CVE-2026-27622","ts":1789368035177,"field":"cvss","old":"8.4","new":"7.4"},{"seq":187580,"id":"CVE-2026-27622","ts":1789364989706,"field":"cvss","old":"7.4","new":"8.4"},{"seq":186367,"id":"CVE-2026-27622","ts":1789362995626,"field":"cvss","old":"8.4","new":"7.4"},{"seq":185153,"id":"CVE-2026-27622","ts":1789360961821,"field":"cvss","old":"7.4","new":"8.4"},{"seq":183940,"id":"CVE-2026-27622","ts":1789357936750,"field":"cvss","old":"8.4","new":"7.4"},{"seq":182192,"id":"CVE-2026-27622","ts":1789354089166,"field":"cvss","old":"7.4","new":"8.4"},{"seq":180985,"id":"CVE-2026-27622","ts":1789352936550,"field":"cvss","old":"8.4","new":"7.4"},{"seq":179778,"id":"CVE-2026-27622","ts":1789349989499,"field":"cvss","old":"7.4","new":"8.4"},{"seq":178571,"id":"CVE-2026-27622","ts":1789347803912,"field":"cvss","old":"8.4","new":"7.4"},{"seq":177364,"id":"CVE-2026-27622","ts":1789346171248,"field":"cvss","old":"7.4","new":"8.4"},{"seq":176157,"id":"CVE-2026-27622","ts":1789342744245,"field":"cvss","old":"8.4","new":"7.4"},{"seq":175941,"id":"CVE-2026-27622","ts":1789342351170,"field":"cvss","old":"7.4","new":"8.4"},{"seq":175481,"id":"CVE-2026-27622","ts":1789338382370,"field":"cvss","old":"8.4","new":"7.4"},{"seq":174276,"id":"CVE-2026-27622","ts":1789334591996,"field":"cvss","old":"7.4","new":"8.4"},{"seq":173071,"id":"CVE-2026-27622","ts":1789333196821,"field":"cvss","old":"8.4","new":"7.4"},{"seq":171885,"id":"CVE-2026-27622","ts":1789330876243,"field":"cvss","old":"7.4","new":"8.4"},{"seq":170699,"id":"CVE-2026-27622","ts":1789328391712,"field":"cvss","old":"8.4","new":"7.4"},{"seq":169494,"id":"CVE-2026-27622","ts":1789326898923,"field":"cvss","old":"7.4","new":"8.4"},{"seq":168289,"id":"CVE-2026-27622","ts":1789323435809,"field":"cvss","old":"8.4","new":"7.4"},{"seq":167084,"id":"CVE-2026-27622","ts":1789319366607,"field":"cvss","old":"7.4","new":"8.4"},{"seq":165879,"id":"CVE-2026-27622","ts":1789318274322,"field":"cvss","old":"8.4","new":"7.4"},{"seq":164674,"id":"CVE-2026-27622","ts":1789315535047,"field":"cvss","old":"7.4","new":"8.4"},{"seq":163469,"id":"CVE-2026-27622","ts":1789313256530,"field":"cvss","old":"8.4","new":"7.4"},{"seq":162264,"id":"CVE-2026-27622","ts":1789311710378,"field":"cvss","old":"7.4","new":"8.4"},{"seq":161059,"id":"CVE-2026-27622","ts":1789308257334,"field":"cvss","old":"8.4","new":"7.4"},{"seq":160564,"id":"CVE-2026-27622","ts":1789304189714,"field":"cvss","old":"7.4","new":"8.4"},{"seq":158402,"id":"CVE-2026-27622","ts":1789299277629,"field":"cvss","old":"8.4","new":"7.4"},{"seq":157366,"id":"CVE-2026-27622","ts":1789296458637,"field":"cvss","old":"7.4","new":"8.4"},{"seq":156161,"id":"CVE-2026-27622","ts":1789294378932,"field":"cvss","old":"8.4","new":"7.4"},{"seq":154956,"id":"CVE-2026-27622","ts":1789292633200,"field":"cvss","old":"7.4","new":"8.4"},{"seq":153751,"id":"CVE-2026-27622","ts":1789289341184,"field":"cvss","old":"8.4","new":"7.4"},{"seq":152963,"id":"CVE-2026-27622","ts":1789285252576,"field":"cvss","old":"7.4","new":"8.4"},{"seq":152207,"id":"CVE-2026-27622","ts":1789280958509,"field":"cvss","old":"8.4","new":"7.4"},{"seq":151168,"id":"CVE-2026-27622","ts":1789277453960,"field":"cvss","old":"7.4","new":"8.4"},{"seq":147897,"id":"CVE-2026-27622","ts":1789270874624,"field":"cvss","old":"8.4","new":"7.4"},{"seq":145937,"id":"CVE-2026-27622","ts":1789269173794,"field":"cvss","old":"7.4","new":"8.4"},{"seq":144840,"id":"CVE-2026-27622","ts":1789266104796,"field":"cvss","old":"8.4","new":"7.4"},{"seq":143744,"id":"CVE-2026-27622","ts":1789262439448,"field":"cvss","old":"7.4","new":"8.4"},{"seq":142580,"id":"CVE-2026-27622","ts":1789261185882,"field":"cvss","old":"8.4","new":"7.4"},{"seq":141416,"id":"CVE-2026-27622","ts":1789258609596,"field":"cvss","old":"7.4","new":"8.4"},{"seq":140218,"id":"CVE-2026-27622","ts":1789256396888,"field":"cvss","old":"8.4","new":"7.4"}]}