CVE-2026-34588High· 8.6▾ TwilightOpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working w…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Last analysed / modified upstream
8.6 → 8.8
8.8 → 8.6
8.6 → 8.8
8.8 → 8.6
8.6 → 8.8
8.8 → 8.6
8.6 → 8.8
8.8 → 8.6
8.6 → 8.8
8.8 → 8.6
8.6 → 8.8
8.8 → 8.6
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
openexr >= 3.1.0, <= 3.1.13openexr >= 3.2.0, < 3.2.7openexr >= 3.3.0, < 3.3.9openexr >= 3.4.0, < 3.4.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
openexr >= 3.1.0, < 3.2.7openexr >= 3.3.0, < 3.3.9openexr >= 3.4.0, < 3.4.9Patched in:
openexr 3.2.7openexr 3.3.9openexr 3.4.9Source: https://osv.dev/vulnerability/GHSA-588r-cr5c-w6hf
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27622High· 8.4OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write
CVE-2026-34589Medium· 5.0OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write
CVE-2026-42216Critical· 9.1OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry
CVE-2026-41142High· 8.8OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry
CVE-2026-15534Medium· 5.7Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each…
CVE-2025-64182High· 7.8OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()