CVE-2026-27622High· 8.4▾ TwilightOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned in…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
8.4 → 7.4
7.4 → 8.4
8.4 → 7.4
7.4 → 8.4
8.4 → 7.4
7.4 → 8.4
8.4 → 7.4
7.4 → 8.4
8.4 → 7.4
7.4 → 8.4
8.4 → 7.4
7.4 → 8.4
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.
openexr >= 2.3.0, < 3.2.6openexr >= 3.3.0, < 3.3.8openexr >= 3.4.0, < 3.4.6Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
openexr >= 2.3.0, < 3.2.6openexr >= 3.3.0, < 3.3.8openexr >= 3.4.0, < 3.4.6Patched in:
openexr 3.2.6openexr 3.3.8openexr 3.4.6Source: https://osv.dev/vulnerability/GHSA-cr4v-6jm6-4963
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-34588High· 8.6OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
CVE-2026-42308Medium· 6.2Pillow: Pillow: Denial of Service via integer overflow in font processing (CVE-2026-42308)
CVE-2026-41142High· 8.8OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry
CVE-2026-5121High· 7.5A flaw was found in libarchive
CVE-2025-64182High· 7.8OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
CVE-2026-34543HighOpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)