CVE-2026-34380 Integer overflow in openexr
A signed integer overflow in OpenEXR's PXR24 decompression can bypass bounds checks, leading to out-of-bounds writes and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34380?
CVE-2026-34380 is a medium-severity vulnerability in Openexr Openexr, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a signed integer overflow exists in undo_pxr24_impl() in src/lib/OpenEXRCore/internal_pxr24.c at line 377. The expression (uint64_t)(w * 3) computes w * 3 as a signed 32-bit integer before casting to uint64_t. When w is large, this multiplication constitutes undefined behavior under the C standard. On tested builds (clang/gcc without sanitizers), two's-complement wraparound commonly occurs, and for specific values of w the wrapped result is a small positive integer, which may allow the subsequent bounds check to pass incorrectly. If the check is bypassed, the decoding loop proceeds to write pixel data through dout, potentially extending far beyond the allocated output buffer. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
Which versions are affected by CVE-2026-34380?
It affects 1 product.
Products include Openexr Openexr.
How do I fix CVE-2026-34380?
Upgrade to a fixed version.
Is CVE-2026-34380 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34380 exists.
Other vulnerabilities in Openexr Openexr
- CVE-2023-5841 OpenEXR Heap Overflow in Scanline Deep Data Parsing
- CVE-2026-41142 OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
- CVE-2026-42216 OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
- CVE-2017-9111 OpenEXR invalid write
- CVE-2017-9113 Memory corruption in n/a
Sources
Also known as BELL-CVE-2026-34380, DEBIAN-CVE-2026-34380, GHSA-q3v8-hw4m-59w5, JLSEC-2026-144, ROOT-OS-DEBIAN-11-CVE-2026-34380, ROOT-OS-DEBIAN-12-CVE-2026-34380 and 2 more.