Junglewise Threat Intelligence

CVE-2026-34589: OpenEXR heap out-of-bounds write in DWA lossy decoder

CVE-2026-34589 · Severity: medium · CVSS 5 · Published 2026-04-06

Technologies: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, AcademySoftwareFoundation OpenEXR. Vendors: Red Hat, PyPI.

Executive brief

OpenEXR is a widely used professional-grade image format for the motion picture and visual effects industry. A vulnerability in its image decoding component allows a specially crafted image file to cause a memory error when opened. This could lead to a program crash or potentially allow an attacker to execute unauthorized code on the user's system, impacting data confidentiality and system availability.

Technical details

An integer overflow vulnerability exists in the DWA lossy decoder of OpenEXR within 'src/lib/OpenEXRCore/internal_dwa_decoder.h'. The issue stems from using signed 32-bit arithmetic to calculate temporary per-component block pointers (numBlocksX * 64). When processing an image with a sufficiently large width, this calculation overflows, causing the resulting pointer to wrap and point outside the allocated 'rowBlock' backing store. Subsequent write operations in 'LossyDctDecoder_execute' then perform out-of-bounds writes. This is reachable via the public decoder path and can be triggered by a crafted scanline DWAA file. Patches are available in versions 3.2.7, 3.3.9, and 3.4.9.

Affected products

  • AcademySoftwareFoundation OpenEXR >= 3.2.0, < 3.2.7; >= 3.3.0, < 3.3.9; >= 3.4.0, < 3.4.9
  • Red Hat Red Hat Enterprise Linux 6 affected
  • Red Hat Red Hat Enterprise Linux 7 affected

Timeline

  • 2026-04-03: patched: Versions 3.2.7, 3.3.9, and 3.4.9 released.
  • 2026-04-05: advisory: GitHub Security Advisory GHSA-p8xc-w3q4-h64x published.
  • 2026-04-06: disclosed: CVE-2026-34589 published.

References

Related threats