CVE-2026-34379: AcademySoftwareFoundation OpenEXR misaligned write in DWA decoder

CVE-2026-34379 · Severity: high · CVSS 7.1 · Published 2026-04-06

OpenEXR is a widely used industry-standard library for handling high-quality image files in the motion picture and visual effects industries. A flaw in how the library processes certain compressed image files can cause applications to crash or behave unpredictably when opening a specially crafted file. This could lead to service disruptions or potentially allow an attacker to compromise systems that automatically process or preview image uploads.

Technologies: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7. Vendors: Red Hat.

Quick answers

Is CVE-2026-34379 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34379 being exploited in the wild.
How severe is CVE-2026-34379?
High severity, with a CVSS score of 7.1, published 6 April 2026.
Which products and versions are affected?
Red Hat Enterprise Linux 6 affected; Red Hat Enterprise Linux 7 affected.
Is there a fix for CVE-2026-34379?
A patch was published on 2026-04-03: Fixed in versions 3.2.7, 3.3.9, and 3.4.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34379 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-34379?
Check whether you run Red Hat Enterprise Linux 6 or Red Hat Enterprise Linux 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A misaligned memory write vulnerability exists in the LossyDctDecoder_execute() function within src/lib/OpenEXRCore/internal_dwa_decoder.h. When decoding DWA or DWAB-compressed EXR files containing FLOAT-type channels, the decoder performs an in-place conversion from 16-bit (HALF) to 32-bit (FLOAT) data. This process involves casting an unaligned uint8_t pointer to a float pointer and writing to it, which violates C alignment standards. On architectures that enforce strict alignment (such as ARM or RISC-V), this results in an immediate crash (DoS). On x86 architectures, while hardware may tolerate the access, compiler optimizations assuming alignment can lead to memory corruption or undefined behavior. The issue is triggered by the lack of alignment padding between channels in the output buffer.

Affected products

  • AcademySoftwareFoundation OpenEXR 3.2.0 to 3.2.6, 3.3.0 to 3.3.8, 3.4.0 to 3.4.8
  • Red Hat Red Hat Enterprise Linux 6 affected
  • Red Hat Red Hat Enterprise Linux 7 affected

Timeline

  • 2026-04-03: patched: Fixed in versions 3.2.7, 3.3.9, and 3.4.9
  • 2026-04-05: advisory: GitHub Security Advisory GHSA-w88v-vqhq-5p24 published
  • 2026-04-06: disclosed: CVE-2026-34379 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.