---
id: CVE-2026-27622
title: OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write
summary: >-
  OpenEXR provides the specification and reference implementation of the EXR
  file format, an image storage format for the motion picture industry. In
  CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in
  vector<unsigned in…
severity: high
cvss: 8.4
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-787
  - CWE-190
vendor: AcademySoftwareFoundation
product: openexr
affected:
  - 'openexr >= 2.3.0, < 3.2.6'
  - 'openexr >= 3.3.0, < 3.3.8'
  - 'openexr >= 3.4.0, < 3.4.6'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-03-10T00:00:00+00:00'
published: '2026-03-03'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T12:04:51.973Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-27622'
references:
  - url: >-
      https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963
    label: >-
      https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27622.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-27622'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2444251'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-27622'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27622'
  - url: 'https://access.redhat.com/errata/RHSA-2026:7678'
  - url: 'https://access.redhat.com/errata/RHSA-2026:7682'
  - url: 'https://access.redhat.com/errata/RHSA-2026:8863'
  - url: 'https://access.redhat.com/errata/RHSA-2026:12340'
  - url: 'https://access.redhat.com/errata/RHSA-2026:12341'
  - url: 'https://access.redhat.com/errata/RHSA-2026:12339'
  - url: 'https://access.redhat.com/errata/RHSA-2026:12338'
  - url: 'https://access.redhat.com/errata/RHSA-2026:8870'
  - url: 'https://access.redhat.com/errata/RHSA-2026:8869'
  - url: 'https://access.redhat.com/errata/RHSA-2026:8871'
  - url: 'https://access.redhat.com/errata/RHSA-2026:8872'
  - url: 'https://access.redhat.com/errata/RHSA-2026:8888'
  - url: 'https://access.redhat.com/errata/RHSA-2026:16008'
  - url: 'https://access.redhat.com/errata/RHSA-2026:16030'
  - url: 'https://access.redhat.com/errata/RHSA-2026:16009'
  - url: 'https://access.redhat.com/errata/RHSA-2026:16174'
  - url: 'https://github.com/AcademySoftwareFoundation/openexr'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00201
epssPercentile: 0.10295
aliases:
  - GHSA-cr4v-6jm6-4963
  - PYSEC-2026-2846
ecosystem: pip
patched:
  - enterprise_linux_appstream_eus_v_10_0
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_8
  - enterprise_linux_appstream_aus_v_8_2
  - enterprise_linux_appstream_aus_v_8_4
  - enterprise_linux_appstream_eus_extension_v_8_4
  - enterprise_linux_appstream_aus_v_8_6
  - enterprise_linux_appstream_e4s_v_8_6
  - enterprise_linux_appstream_tus_v_8_6
  - enterprise_linux_appstream_e4s_v_8_8
  - enterprise_linux_appstream_tus_v_8_8
  - enterprise_linux_appstream_e4s_v_9_0
  - enterprise_linux_appstream_e4s_v_9_2
  - enterprise_linux_appstream_eus_v_9_4
  - enterprise_linux_appstream_eus_v_9_6
  - enterprise_linux_appstream_v_9
  - enterprise_linux_codeready_linux_builder_v_10
  - enterprise_linux_crb_v_8
  - codeready_linux_builder_eus_v_9_4
  - codeready_linux_builder_eus_v_9_6
  - enterprise_linux_codeready_linux_builder_v_9
  - ai_inference_server 3.3
scores:
  cna: 8.4
  vendor: 7.4
ingestedAt: '2026-07-13T18:57:56.829Z'
---

## Overview

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.

## Affected

- `openexr >= 2.3.0, < 3.2.6`
- `openexr >= 3.3.0, < 3.3.8`
- `openexr >= 3.4.0, < 3.4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-27622)

Affected packages:

- `openexr >= 2.3.0, < 3.2.6`
- `openexr >= 3.3.0, < 3.3.8`
- `openexr >= 3.4.0, < 3.4.6`

Patched in:

- `openexr 3.2.6`
- `openexr 3.3.8`
- `openexr 3.4.6`

Source: https://osv.dev/vulnerability/GHSA-cr4v-6jm6-4963

## Vendor advisories

- **RHSA-2026:7678** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-04-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:7678)
- **RHSA-2026:7682** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-04-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:7682)
- **RHSA-2026:8863** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8863)
- **RHSA-2026:12340** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12340)
- **RHSA-2026:12341** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12341)
- **RHSA-2026:12339** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12339)
- **RHSA-2026:12338** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12338)
- **RHSA-2026:8870** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.0) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8870)
- **RHSA-2026:8869** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8869)
- **RHSA-2026:8871** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat CodeReady Linux Builder EUS (v.9.4) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8871)
- **RHSA-2026:8872** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8872)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27622.json)