CVE-2026-34588: OpenEXR integer overflow in PIZ decoder leads to OOB read and write

CVE-2026-34588 · Severity: high · CVSS 7.8 · Published 2026-04-06

OpenEXR is a widely used industry-standard library for processing high-quality image files in the motion picture and visual effects industry. A security flaw in how the library handles specific image compression (PIZ) could allow a malicious image file to corrupt memory when opened. This could lead to application crashes, unauthorized data access, or potentially allow an attacker to execute malicious code on the affected system.

Technologies: OpenEXR (PyPI), Red Hat Enterprise Linux AppStream. Vendors: PyPI, Red Hat.

Quick answers

Is CVE-2026-34588 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34588 being exploited in the wild.
How severe is CVE-2026-34588?
High severity, with a CVSS score of 7.8, published 6 April 2026.
Which products and versions are affected?
OpenEXR (PyPI) ECOSYSTEM:introduced=3.1.0,fixed=3.2.7, ECOSYSTEM:introduced=3.1.0,fixed=3.2.7,introduced=3.3.0,fixed=3.3.9,introduced=3.4.0,fixed=3.4.9; Red Hat Enterprise Linux AppStream 9, 10.
Is there a fix for CVE-2026-34588?
Yes. OpenEXR (PyPI): upgrade to 3.2.7, 3.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34588 attacked?
It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2026-34588?
Check whether you run OpenEXR (PyPI) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • OpenEXR (PyPI): upgrade to 3.2.7, 3.4.9 or later
    pip install "OpenEXR>=3.4.9"

Technical details

An integer overflow vulnerability exists in the 'internal_exr_undo_piz()' function within OpenEXR's PIZ decoder. The root cause is the use of signed 32-bit arithmetic when advancing the working wavelet pointer ('wavbuf += nx * ny * wcount'). Because the variables 'nx', 'ny', and 'wcount' are integers, a crafted EXR file can cause the product to overflow and wrap, leading the decoder to operate on an incorrect memory address. Since the wavelet decode path operates in-place, this results in both out-of-bounds (OOB) reads and OOB writes. The vulnerability is fixed in versions 3.2.7, 3.3.9, and 3.4.9.

Affected products

  • AcademySoftwareFoundation OpenEXR 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9
  • Red Hat Red Hat Enterprise Linux AppStream 9, 10

Identifiers

  • CVE-2026-34588
  • GHSA-588r-cr5c-w6hf
  • PYSEC-2026-2845

Timeline

  • 2026-04-03: patched: OpenEXR versions 3.2.7, 3.3.9, and 3.4.9 released
  • 2026-04-05: advisory: GitHub Security Advisory GHSA-588r-cr5c-w6hf published
  • 2026-04-06: disclosed: CVE-2026-34588 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.