# CVE-2026-34378: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for…

Source: https://junglewise.ai/threats/cve-2026-34378-openexr-provides-the-specification-and-reference-implementation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06  
License: CC BY 4.0 with a link back

CVE-2026-34378 · Severity: medium · CVSS 6.5 · Published 2026-04-06

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overflow in generic_unpack(). By setting dataWindow.min.x to a large negative value, OpenEXRCore computes an enormous image width, which is later used in a signed integer multiplication that overflows, causing the process to terminate with SIGILL via UBSan. This vulnerability is fixed in 3.4.9.

Technologies: [Openexr](https://junglewise.ai/threats/technologies/openexr-openexr). Vendors: [Openexr](https://junglewise.ai/threats/vendors/openexr).

## Quick answers

**Is CVE-2026-34378 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34378 being exploited in the wild.

**How severe is CVE-2026-34378?** Medium severity, with a CVSS score of 6.5, published 6 April 2026.

**Which products and versions are affected?** Openexr. The advisory does not name versions.

**Is there a fix for CVE-2026-34378?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-34378?** Check whether you run Openexr. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Openexr

## Related threats

- [OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for…](https://junglewise.ai/threats/cve-2026-42217-openexr-provides-the-specification-and-reference-implementation)
- [OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for…](https://junglewise.ai/threats/cve-2026-40250-openexr-provides-the-specification-and-reference-implementation)
- [OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for…](https://junglewise.ai/threats/cve-2026-39886-openexr-provides-the-specification-and-reference-implementation)
- [OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for…](https://junglewise.ai/threats/cve-2026-34380-openexr-provides-the-specification-and-reference-implementation)
- [PYSEC-2026-2847 - OpenEXR: integer overflow to OOB write in uncompress_b44_impl()](https://junglewise.ai/threats/cve-2026-34544-openexr-integer-overflow-to-oob-write-in-uncompress-b44-impl)