CVE-2026-34543 OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
Attackers can leak sensitive heap memory information by tricking users into opening malicious EXR files using the OpenEXR library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34543?
CVE-2026-34543 is a high-severity vulnerability in Openexr Openexr, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, sensitive information from heap memory may be leaked through the decoded pixel data (information disclosure). This occurs under default settings; simply reading a malicious EXR file is sufficient to trigger the issue, without any user interaction. This issue has been patched in version 3.4.8.
Weakness: CWE-908
Which versions are affected by CVE-2026-34543?
7 open source packages ship an affected version, including openexr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openexr PyPI | From 3.2.0 to 3.2.6 | None |
openexr PyPI | From 3.2.0 to 3.2.6 | None |
openexr PyPI | From 3.2.0 | 3.4.8 |
openexr PyPI | From 3.3.0 to 3.3.8 | None |
openexr PyPI | From 3.3.0 to 3.3.8 | None |
openexr PyPI | From 3.4.0 | 3.4.8 |
1 more packages
openexr PyPI | From 3.4.0 | 3.4.8 |
Products include Openexr Openexr.
How do I fix CVE-2026-34543?
Upgrade openexr to 3.4.8 or later.
Is CVE-2026-34543 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34543 exists.
Other vulnerabilities in Openexr Openexr
- CVE-2023-5841 OpenEXR Heap Overflow in Scanline Deep Data Parsing
- CVE-2026-41142 OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
- CVE-2026-42216 OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
- CVE-2017-9111 OpenEXR invalid write
- CVE-2017-9113 Memory corruption in n/a
Sources
Also known as BELL-CVE-2026-34543, DEBIAN-CVE-2026-34543, GHSA-vc68-257w-m432, JLSEC-2026-145, PYSEC-2026-2850, ROOT-OS-DEBIAN-11-CVE-2026-34543 and 3 more.