# CVE-2026-40244: OpenEXR integer overflow in DWA compressor

Source: https://junglewise.ai/threats/cve-2026-40244-openexr-integer-overflow-in-dwa-compressor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-40244 · Severity: high · CVSS 7.1 · Published 2026-04-21

OpenEXR is a widely used industry-standard library for handling high-quality image files in the motion picture and visual effects industry. A vulnerability in how the library processes certain compressed image files could allow an attacker to crash applications or potentially execute malicious code if a user opens a specially crafted, oversized image. This could lead to data theft, system compromise, or service disruptions for studios and artists using affected software.

## Quick answers

**Is CVE-2026-40244 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40244 being exploited in the wild.

**How severe is CVE-2026-40244?** High severity, with a CVSS score of 7.1, published 21 April 2026.

**Which products and versions are affected?** AcademySoftwareFoundation OpenEXR 3.2.0-3.2.7, 3.3.0-3.3.9, 3.4.0-3.4.9.

**Is there a fix for CVE-2026-40244?** A patch was published on 2026-04-17: Versions 3.2.8, 3.3.10, and 3.4.10 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40244 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-40244?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in `internal_dwa_compressor.h` within the `setupChannelData` function. The flaw occurs because the library performs `curc->width * curc->height` using 32-bit integer arithmetic without proper casting to `size_t`. When processing images with dimensions that exceed the `INT32_MAX` limit, the multiplication wraps around, resulting in an incorrect pointer offset for `planarUncRle`. This causes subsequent RLE decoding operations to write data to unintended heap locations. The vulnerability specifically affects non-DCT channels (such as UINT or single-channel layouts) using DWA compression. Patches are available in versions 3.2.8, 3.3.10, and 3.4.10.

## Affected products

- AcademySoftwareFoundation OpenEXR 3.2.0-3.2.7, 3.3.0-3.3.9, 3.4.0-3.4.9

## Timeline

- 2026-04-17: patched: Versions 3.2.8, 3.3.10, and 3.4.10 released
- 2026-04-18: advisory: GitHub Security Advisory published
- 2026-04-21: disclosed: CVE-2026-40244 published

## References

- [https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.8](https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.8)
- [https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.10](https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.10)
- [https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.10](https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.10)
- [https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-j526-66f6-fxhx](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-j526-66f6-fxhx)
- [https://access.redhat.com/security/cve/CVE-2026-40244](https://access.redhat.com/security/cve/CVE-2026-40244)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2459955](https://bugzilla.redhat.com/show_bug.cgi?id=2459955)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40244.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40244.json)