CVE-2026-34545
Heap Buffer Overflow in OpenEXR 3.4.x Enables RCE
Publication date: 2026-04-01
Last updated on: 2026-04-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openexr | openexr | From 3.4.0 (inc) to 3.4.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenEXR versions from 3.4.0 to before 3.4.7. It involves a heap buffer overflow when an attacker provides a specially crafted .exr file that uses HTJ2K compression with a channel width of 32768. This crafted file allows writing controlled data beyond the allocated heap buffer during image decoding.
The overflow writes 2 or 4 bytes per iteration for each pixel beyond the overflow point, potentially enabling an attacker to execute arbitrary code remotely on affected systems. The issue was fixed in version 3.4.7.
How can this vulnerability impact me? :
The vulnerability can lead to remote code execution on systems that decode maliciously crafted EXR image files. This means an attacker could potentially run arbitrary code with the privileges of the application processing the EXR files, leading to system compromise, data theft, or further attacks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update OpenEXR to version 3.4.7 or later, as this version contains the patch that fixes the heap buffer overflow issue.
Avoid processing untrusted or crafted .exr files with HTJ2K compression and unusually large channel widths until the update is applied.