CVE-2026-27622 OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write
An integer overflow in OpenEXR's CompositeDeepScanLine allows heap out-of-bounds writes, potentially leading to code execution or crashes when processing malicious images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27622?
CVE-2026-27622 is a high-severity vulnerability in Openexr Openexr, published on 3 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.
Which versions are affected by CVE-2026-27622?
7 open source packages ship an affected version, including openexr and OpenEXR. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openexr PyPI | From 2.3.0 | 3.2.6, 3.3.8, 3.4.6 |
openexr PyPI | From 2.3.0 | 3.2.6 |
openexr PyPI | From 3.3.0 | 3.3.8 |
openexr PyPI | From 3.4.0 | 3.4.6 |
OpenEXR PyPI | From 2.3.0 | 3.2.6 |
OpenEXR PyPI | From 3.3.0 | 3.3.8 |
1 more packages
OpenEXR PyPI | From 3.4.0 | 3.4.6 |
Linux distribution packages (33)
openexr AlmaLinux:10 | All versions | 3.1.10-8.el10_1.1 |
openexr-devel AlmaLinux:10 | All versions | 3.1.10-8.el10_1.1 |
openexr-libs AlmaLinux:10 | All versions | 3.1.10-8.el10_1.1 |
OpenEXR-devel AlmaLinux:8 | All versions | 2.2.0-12.el8_10.1 |
OpenEXR-libs AlmaLinux:8 | All versions | 2.2.0-12.el8_10.1 |
openexr AlmaLinux:9 | All versions | 3.1.1-3.el9_7.1 |
openexr-devel AlmaLinux:9 | All versions | 3.1.1-3.el9_7.1 |
openexr-libs AlmaLinux:9 | All versions | 3.1.1-3.el9_7.1 |
openexr Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.1 |
openexr-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.1 |
openexr-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.1 |
openexr-devel Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.1 |
openexr-libs Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.1 |
openexr-libs-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.1 |
OpenEXR Red Hat:enterprise_linux:8::appstream | All versions | 0:2.2.0-12.el8_10.1 |
OpenEXR-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.2.0-12.el8_10.1 |
OpenEXR-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:2.2.0-12.el8_10.1 |
OpenEXR-libs Red Hat:enterprise_linux:8::appstream | All versions | 0:2.2.0-12.el8_10.1 |
OpenEXR-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.2.0-12.el8_10.1 |
OpenEXR-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.2.0-12.el8_10.1 |
OpenEXR-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:2.2.0-12.el8_10.1 |
OpenEXR-devel Red Hat:enterprise_linux:8::crb | All versions | 0:2.2.0-12.el8_10.1 |
OpenEXR-libs-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.2.0-12.el8_10.1 |
openexr Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_7.1 |
openexr-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_7.1 |
openexr-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_7.1 |
openexr-libs Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_7.1 |
openexr-libs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_7.1 |
openexr-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:3.1.1-3.el9_7.1 |
openexr-debugsource Red Hat:enterprise_linux:9::crb | All versions | 0:3.1.1-3.el9_7.1 |
openexr-devel Red Hat:enterprise_linux:9::crb | All versions | 0:3.1.1-3.el9_7.1 |
openexr-libs-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:3.1.1-3.el9_7.1 |
openexr Red Hat:enterprise_linux_eus:10.0 | All versions | 0:3.1.10-8.el10_0.1 |
Products include Openexr Openexr.
How do I fix CVE-2026-27622?
Upgrade openexr to a fixed version for your release line: 3.2.6, 3.3.8 or 3.4.6.
Is CVE-2026-27622 being exploited?
There is no known exploitation of CVE-2026-27622 in the wild and no public exploit code.
Other vulnerabilities in Openexr Openexr
- CVE-2023-5841 OpenEXR Heap Overflow in Scanline Deep Data Parsing
- CVE-2026-41142 OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
- CVE-2026-42216 OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
- CVE-2017-9111 OpenEXR invalid write
- CVE-2017-9113 Memory corruption in n/a
Sources
Also known as ALSA-2026:7682, ALSA-2026:8863, ALSA-2026:8888, CLSA-2026-1773831456, CLSA-2026-1774604404, CLSA-2026-1787317469 and 37 more.