CVE-2026-34588 OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
A signed integer overflow in the PIZ decoder allows attackers to trigger out-of-bounds reads and writes via crafted EXR files, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34588?
CVE-2026-34588 is a high-severity vulnerability in Openexr Openexr, published on 6 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
Which versions are affected by CVE-2026-34588?
7 open source packages ship an affected version, including openexr and OpenEXR. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openexr PyPI | From 3.1.0 | 3.2.7, 3.3.9, 3.4.9 |
openexr PyPI | From 3.1.0 | 3.2.7 |
openexr PyPI | From 3.3.0 | 3.3.9 |
openexr PyPI | From 3.4.0 | 3.4.9 |
OpenEXR PyPI | From 3.1.0 | 3.2.7 |
OpenEXR PyPI | From 3.3.0 | 3.3.9 |
1 more packages
OpenEXR PyPI | From 3.4.0 | 3.4.9 |
Linux distribution packages (33)
openexr AlmaLinux:10 | All versions | 3.1.10-8.el10_1.2 |
openexr AlmaLinux:10 | All versions | 3.1.10-8.el10_2.2 |
openexr-devel AlmaLinux:10 | All versions | 3.1.10-8.el10_1.2 |
openexr-devel AlmaLinux:10 | All versions | 3.1.10-8.el10_2.2 |
openexr-libs AlmaLinux:10 | All versions | 3.1.10-8.el10_1.2 |
openexr-libs AlmaLinux:10 | All versions | 3.1.10-8.el10_2.2 |
openexr AlmaLinux:9 | All versions | 3.1.1-3.el9_7.2 |
openexr AlmaLinux:9 | All versions | 3.1.1-3.el9_8.2 |
openexr-devel AlmaLinux:9 | All versions | 3.1.1-3.el9_7.2 |
openexr-devel AlmaLinux:9 | All versions | 3.1.1-3.el9_8.2 |
openexr-libs AlmaLinux:9 | All versions | 3.1.1-3.el9_7.2 |
openexr-libs AlmaLinux:9 | All versions | 3.1.1-3.el9_8.2 |
openexr Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.2 |
openexr-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.2 |
openexr-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.2 |
openexr-devel Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.2 |
openexr-libs Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.2 |
openexr-libs-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.1.10-8.el10_1.2 |
openexr Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.2 |
openexr-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.2 |
openexr-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.2 |
openexr-devel Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.2 |
openexr-libs Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.2 |
openexr-libs-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.2 |
openexr Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_7.2 |
openexr Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_8.2 |
openexr-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_7.2 |
openexr-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_8.2 |
openexr-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_7.2 |
openexr-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_8.2 |
openexr-libs Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_7.2 |
openexr-libs Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_8.2 |
openexr-libs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_7.2 |
Products include Openexr Openexr.
How do I fix CVE-2026-34588?
Upgrade openexr to a fixed version for your release line: 3.2.7, 3.3.9 or 3.4.9.
Is CVE-2026-34588 being exploited?
There is no known exploitation of CVE-2026-34588 in the wild and no public exploit code.
Other vulnerabilities in Openexr Openexr
- CVE-2023-5841 OpenEXR Heap Overflow in Scanline Deep Data Parsing
- CVE-2026-41142 OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
- CVE-2026-42216 OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
- CVE-2017-9111 OpenEXR invalid write
- CVE-2017-9113 Memory corruption in n/a
Sources
Also known as ALSA-2026:15887, ALSA-2026:15888, ALSA-2026:19146, ALSA-2026:19359, BELL-CVE-2026-34588, CLSA-2026-1776950014 and 23 more.