Junglewise Threat Intelligence

CVE-2026-34379: AcademySoftwareFoundation OpenEXR misaligned write in DWA decoder

CVE-2026-34379 · Severity: high · CVSS 7.1 · Published 2026-04-06

Technologies: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, AcademySoftwareFoundation OpenEXR. Vendors: Red Hat.

Executive brief

OpenEXR is a widely used industry-standard library for handling high-quality image files in the motion picture and visual effects industries. A flaw in how the library processes certain compressed image files can cause applications to crash or behave unpredictably when opening a specially crafted file. This could lead to service disruptions or potentially allow an attacker to compromise systems that automatically process or preview image uploads.

Technical details

A misaligned memory write vulnerability exists in the LossyDctDecoder_execute() function within src/lib/OpenEXRCore/internal_dwa_decoder.h. When decoding DWA or DWAB-compressed EXR files containing FLOAT-type channels, the decoder performs an in-place conversion from 16-bit (HALF) to 32-bit (FLOAT) data. This process involves casting an unaligned uint8_t pointer to a float pointer and writing to it, which violates C alignment standards. On architectures that enforce strict alignment (such as ARM or RISC-V), this results in an immediate crash (DoS). On x86 architectures, while hardware may tolerate the access, compiler optimizations assuming alignment can lead to memory corruption or undefined behavior. The issue is triggered by the lack of alignment padding between channels in the output buffer.

Affected products

  • AcademySoftwareFoundation OpenEXR 3.2.0 to 3.2.6, 3.3.0 to 3.3.8, 3.4.0 to 3.4.8
  • Red Hat Red Hat Enterprise Linux 6 affected
  • Red Hat Red Hat Enterprise Linux 7 affected

Timeline

  • 2026-04-03: patched: Fixed in versions 3.2.7, 3.3.9, and 3.4.9
  • 2026-04-05: advisory: GitHub Security Advisory GHSA-w88v-vqhq-5p24 published
  • 2026-04-06: disclosed: CVE-2026-34379 published to NVD

References

Related threats