Junglewise Threat Intelligence

CVE-2026-27622: OpenEXR heap out-of-bounds write in CompositeDeepScanLine

CVE-2026-27622 · Severity: high · CVSS 7.8 · Published 2026-03-03

Technologies: Academy Software Foundation OpenEXR, OpenEXR (PyPI). Vendors: Academy Software Foundation, PyPI.

Executive brief

OpenEXR is a widely used image format in the motion picture and visual effects industry for storing high-quality graphics. A vulnerability in how the software processes certain image files could allow an attacker to execute malicious code or crash applications that open a specially crafted EXR file. This could lead to the theft of sensitive data, disruption of production workflows, or unauthorized access to workstations used by digital artists and editors.

Technical details

An integer overflow vulnerability exists in the 'CompositeDeepScanLine::readPixels' function of OpenEXR. When processing multipart deep EXR files, per-pixel totals are accumulated in a 32-bit unsigned integer vector ('total_sizes'). An attacker can provide a file with excessively large sample counts that cause this counter to wrap modulo 2^32. This results in an undersized buffer being allocated via 'samples[channel].resize()'. Subsequent decoding operations in 'generic_unpack_deep_pointers' use the original, large sample counts, leading to a heap-based out-of-bounds write. The vulnerability is reachable via high-level multipart deep read flows and has been patched in versions 3.2.6, 3.3.8, and 3.4.6.

Affected products

  • Academy Software Foundation OpenEXR 2.x, 3.0.x, 3.1.x, 3.2.0-3.2.5, 3.3.0-3.3.7, 3.4.0-3.4.5

Timeline

  • 2026-03-02: advisory: GitHub Security Advisory published by Academy Software Foundation
  • 2026-03-03: disclosed: NVD publication date
  • 2026-04-30: patched: Red Hat released security updates for RHEL 8.8

References

Related threats