# CVE-2026-34588: OpenEXR integer overflow in PIZ decoder leads to OOB read and write

Source: https://junglewise.ai/threats/cve-2026-34588-openexr-integer-overflow-in-piz-decoder-leads-to-oob-read-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-34588 · Severity: high · CVSS 7.8 · Published 2026-04-06

OpenEXR is a widely used industry-standard library for processing high-quality image files in the motion picture and visual effects industry. A security flaw in how the library handles specific image compression (PIZ) could allow a malicious image file to corrupt memory when opened. This could lead to application crashes, unauthorized data access, or potentially allow an attacker to execute malicious code on the affected system.

Technologies: [OpenEXR (PyPI)](https://junglewise.ai/threats/technologies/openexr), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-34588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34588 being exploited in the wild.

**How severe is CVE-2026-34588?** High severity, with a CVSS score of 7.8, published 6 April 2026.

**Which products and versions are affected?** OpenEXR (PyPI) ECOSYSTEM:introduced=3.1.0,fixed=3.2.7, ECOSYSTEM:introduced=3.1.0,fixed=3.2.7,introduced=3.3.0,fixed=3.3.9,introduced=3.4.0,fixed=3.4.9; Red Hat Enterprise Linux AppStream 9, 10.

**Is there a fix for CVE-2026-34588?** Yes. OpenEXR (PyPI): upgrade to 3.2.7, 3.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34588 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-34588?** Check whether you run OpenEXR (PyPI) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- OpenEXR (PyPI): upgrade to 3.2.7, 3.4.9 or later

  ```sh
  pip install "OpenEXR>=3.4.9"
  ```


## Technical details

An integer overflow vulnerability exists in the 'internal_exr_undo_piz()' function within OpenEXR's PIZ decoder. The root cause is the use of signed 32-bit arithmetic when advancing the working wavelet pointer ('wavbuf += nx * ny * wcount'). Because the variables 'nx', 'ny', and 'wcount' are integers, a crafted EXR file can cause the product to overflow and wrap, leading the decoder to operate on an incorrect memory address. Since the wavelet decode path operates in-place, this results in both out-of-bounds (OOB) reads and OOB writes. The vulnerability is fixed in versions 3.2.7, 3.3.9, and 3.4.9.

## Affected products

- AcademySoftwareFoundation OpenEXR 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9
- Red Hat Red Hat Enterprise Linux AppStream 9, 10

## Identifiers

- CVE-2026-34588
- GHSA-588r-cr5c-w6hf
- PYSEC-2026-2845

## Timeline

- 2026-04-03: patched: OpenEXR versions 3.2.7, 3.3.9, and 3.4.9 released
- 2026-04-05: advisory: GitHub Security Advisory GHSA-588r-cr5c-w6hf published
- 2026-04-06: disclosed: CVE-2026-34588 published to NVD

## References

- [https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.7](https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.7)
- [https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.9](https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.9)
- [https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9](https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9)
- [https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf)
- [https://access.redhat.com/errata/RHSA-2026:15887](https://access.redhat.com/errata/RHSA-2026:15887)
- [https://access.redhat.com/errata/RHSA-2026:15888](https://access.redhat.com/errata/RHSA-2026:15888)
- [https://access.redhat.com/errata/RHSA-2026:17656](https://access.redhat.com/errata/RHSA-2026:17656)

## Related threats

- [PYSEC-2026-2849 - OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp](https://junglewise.ai/threats/cve-2026-26981-openexr-has-heap-buffer-overflow-via-signed-integer-underflow-in)
- [PYSEC-2026-2844 - OpenEXR has use after free in PyObject_StealAttrString](https://junglewise.ai/threats/cve-2025-64183-openexr-has-use-after-free-in-pyobject-stealattrstring)
- [PYSEC-2026-2851 - OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()](https://junglewise.ai/threats/cve-2025-64182-openexr-has-buffer-overflow-in-pyopenexr-old-s-channels-and)
- [PYSEC-2026-2843 - OpenEXR Makes Use of Uninitialized Memory](https://junglewise.ai/threats/cve-2025-64181-openexr-use-of-uninitialized-memory-in-generic-unpack)
- [PYSEC-2026-1748 - OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode](https://junglewise.ai/threats/cve-2025-48073-openexr-scanlineprocess-run-fill-null-pointer-write-in)