CVE-2026-34378

The record

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overflow in generic_unpack(). By setting dataWindow.min.x to a large negative value, OpenEXRCore computes an enormous image width, which is later used in a signed integer multiplication that overflows, causing the process to terminate with SIGILL via UBSan. This vulnerability is fixed in 3.4.9.

Affected packages

Related vulnerabilities

• CVE-2026-44663 OpenEXR is the reference implementation and specification for the EXR image format… Also affects openexr
• CVE-2026-45696 OpenEXR is the reference implementation and specification for the EXR image format… Also affects openexr
• CVE-2026-42217 OpenEXR provides the specification and reference implementation of the EXR file format… Also affects openexr
• CVE-2026-42216 OpenEXR provides the specification and reference implementation of the EXR file format… Also affects openexr
• CVE-2026-41142 OpenEXR provides the specification and reference implementation of the EXR file format… Also affects openexr
• CVE-2026-40250 OpenEXR provides the specification and reference implementation of the EXR file format… Also affects openexr
• CVE-2026-40244 OpenEXR provides the specification and reference implementation of the EXR file format… Also affects openexr
• CVE-2026-39886 OpenEXR provides the specification and reference implementation of the EXR file format… Also affects openexr