Is CVE-2026-27622 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27622 being exploited in the wild.

How severe is CVE-2026-27622?

High severity, with a CVSS score of 7.8, published 3 March 2026.

Which products and versions are affected?

OpenEXR (PyPI) ECOSYSTEM:introduced=2.3.0,fixed=3.2.6, ECOSYSTEM:introduced=2.3.0,fixed=3.2.6,introduced=3.3.0,fixed=3.3.8,introduced=3.4.0,fixed=3.4.6.

Is there a fix for CVE-2026-27622?

Yes. OpenEXR (PyPI): upgrade to 3.2.6, 3.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27622 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-27622?

Check whether you run OpenEXR (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27622: OpenEXR heap out-of-bounds write in CompositeDeepScanLine

CVE-2026-27622 · Severity: high · CVSS 7.8 · Published 2026-03-03

OpenEXR is a widely used image format in the motion picture and visual effects industry for storing high-quality graphics. A vulnerability in how the software processes certain image files could allow an attacker to execute malicious code or crash applications that open a specially crafted EXR file. This could lead to the theft of sensitive data, disruption of production workflows, or unauthorized access to workstations used by digital artists and editors.

Technologies: OpenEXR (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-27622 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27622 being exploited in the wild.
How severe is CVE-2026-27622?: High severity, with a CVSS score of 7.8, published 3 March 2026.
Which products and versions are affected?: OpenEXR (PyPI) ECOSYSTEM:introduced=2.3.0,fixed=3.2.6, ECOSYSTEM:introduced=2.3.0,fixed=3.2.6,introduced=3.3.0,fixed=3.3.8,introduced=3.4.0,fixed=3.4.6.
Is there a fix for CVE-2026-27622?: Yes. OpenEXR (PyPI): upgrade to 3.2.6, 3.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27622 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-27622?: Check whether you run OpenEXR (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

OpenEXR (PyPI): upgrade to 3.2.6, 3.4.6 or later
```
pip install "OpenEXR>=3.4.6"
```

Technical details

An integer overflow vulnerability exists in the 'CompositeDeepScanLine::readPixels' function of OpenEXR. When processing multipart deep EXR files, per-pixel totals are accumulated in a 32-bit unsigned integer vector ('total_sizes'). An attacker can provide a file with excessively large sample counts that cause this counter to wrap modulo 2^32. This results in an undersized buffer being allocated via 'samples[channel].resize()'. Subsequent decoding operations in 'generic_unpack_deep_pointers' use the original, large sample counts, leading to a heap-based out-of-bounds write. The vulnerability is reachable via high-level multipart deep read flows and has been patched in versions 3.2.6, 3.3.8, and 3.4.6.

Affected products

Academy Software Foundation OpenEXR 2.x, 3.0.x, 3.1.x, 3.2.0-3.2.5, 3.3.0-3.3.7, 3.4.0-3.4.5

Identifiers

CVE-2026-27622
GHSA-cr4v-6jm6-4963
PYSEC-2026-2846

Timeline

2026-03-02: advisory: GitHub Security Advisory published by Academy Software Foundation
2026-03-03: disclosed: NVD publication date
2026-04-30: patched: Red Hat released security updates for RHEL 8.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.