CVE-2026-27622
Received Received - Intake
Integer Overflow in OpenEXR readPixels Causes Buffer Overflow

Publication date: 2026-03-03

Last updated on: 2026-03-05

Assigner: GitHub, Inc.

Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-03
Last Modified
2026-03-05
Generated
2026-06-16
AI Q&A
2026-03-04
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27622
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
openexr openexr to 3.2.6 (exc)
openexr openexr From 3.3.0 (inc) to 3.3.8 (exc)
openexr openexr From 3.4.0 (inc) to 3.4.6 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

I don't know

Executive Summary

This vulnerability exists in OpenEXR's CompositeDeepScanLine::readPixels function, where per-pixel totals are accumulated in a vector of unsigned integers. An attacker can control large counts across many parts, causing the totals to wrap around modulo 2^32. This wrapping leads to an incorrect overall sample count, which is then used to resize a sample buffer to a size smaller than needed. Subsequent operations write beyond the bounds of this undersized buffer, causing a buffer overrun.

The issue is fixed in OpenEXR versions 3.2.6, 3.3.8, and 3.4.6.

Impact Analysis

This vulnerability can lead to a buffer overrun, which may cause application crashes, data corruption, or potentially allow an attacker to execute arbitrary code or escalate privileges within the affected system.

Compliance Impact

I don't know

Mitigation Strategies

The vulnerability is fixed in OpenEXR versions 3.2.6, 3.3.8, and 3.4.6.

To mitigate this vulnerability, you should upgrade your OpenEXR installation to one of these fixed versions as soon as possible.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27622. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart