CVE-2026-34545

Modified Modified - Updated After Analysis

Heap Buffer Overflow in OpenEXR 3.4.x Enables RCE

Publication date: 2026-04-01

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.7, an attacker providing a crafted .exr file with HTJ2K compression and a channel width of 32768 can write controlled data beyond the output heap buffer in any application that decodes EXR images. The write primitive is 2 bytes per overflow iteration or 4 bytes (by another path), repeating for each additional pixel past the overflow point. In this context, a heap write overflow can lead to remote code execution on systems. This issue has been patched in version 3.4.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-01

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-04-02

EPSS Evaluated

2026-07-05

NVD

CVE-2026-34545

Affected Vendors & Products

Vendor	Product	Version / Range
openexr	openexr	From 3.4.0 (inc) to 3.4.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenEXR versions from 3.4.0 to before 3.4.7. It involves a heap buffer overflow when an attacker provides a specially crafted .exr file that uses HTJ2K compression with a channel width of 32768. This crafted file allows writing controlled data beyond the allocated heap buffer during image decoding.

The overflow writes 2 or 4 bytes per iteration for each pixel beyond the overflow point, potentially enabling an attacker to execute arbitrary code remotely on affected systems. The issue was fixed in version 3.4.7.

Impact Analysis

The vulnerability can lead to remote code execution on systems that decode maliciously crafted EXR image files. This means an attacker could potentially run arbitrary code with the privileges of the application processing the EXR files, leading to system compromise, data theft, or further attacks.

Mitigation Strategies

To mitigate this vulnerability, you should update OpenEXR to version 3.4.7 or later, as this version contains the patch that fixes the heap buffer overflow issue.

Avoid processing untrusted or crafted .exr files with HTJ2K compression and unusually large channel widths until the update is applied.

Hi! I’m here to help you understand CVE-2026-34545. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70