Executive Summary

CVE-2026-34588 is a high-severity vulnerability in the OpenEXR library's PIZ decoder affecting versions 3.1.0 through 3.4.8. The issue occurs because the function internal_exr_undo_piz() uses signed 32-bit arithmetic to advance a working wavelet pointer by calculating wavbuf += nx * ny * wcount, where nx, ny, and wcount are signed 32-bit integers.

A specially crafted EXR file can cause the multiplication nx * ny * wcount to overflow and wrap around, making the wavbuf pointer point to an incorrect memory address. Since the wavelet decode operates in-place, this results in out-of-bounds reads and writes during the decoding process.

Specifically, the overflow causes the next channel's decode to operate on an incorrect address, leading to heap-buffer-overflow conditions confirmed by memory error detection tools. This can be triggered by EXR files with extremely large dimensions that cause the arithmetic overflow.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a crafted EXR file to cause out-of-bounds memory access during PIZ decompression, which can lead to process crashes and memory corruption.

Depending on the memory layout, it may also allow more severe exploitation, potentially compromising the affected system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by analyzing the behavior of the OpenEXR library when processing EXR files, especially those with extremely large dimensions that may cause integer overflow in the wavelet decoding process.

Detection can be performed by running the vulnerable OpenEXR decoder under memory error detection tools such as AddressSanitizer (ASAN) or Valgrind, which have confirmed invalid out-of-bounds reads and writes triggered by crafted EXR files.

Suggested commands include:

• Run the OpenEXR decoder with AddressSanitizer enabled to detect heap-buffer-overflow errors.
• Use Valgrind to monitor the decoder for invalid memory accesses: valgrind --tool=memcheck ./openexr_decoder <crafted_exr_file>
• Check for unusually large or suspicious EXR files with dimensions that could cause integer overflow, for example, width around 67,108,862 and height 32.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the OpenEXR library to a fixed version where this vulnerability is resolved.

• Upgrade to OpenEXR version 3.2.7, 3.3.9, or 3.4.9 or later, where the integer overflow and out-of-bounds access issues have been fixed.
• If upgrading is not immediately possible, avoid processing untrusted or specially crafted EXR files with extremely large dimensions that could trigger the overflow.
• Implement input validation to reject EXR files where the product of width, height, and channel sampling factors could overflow 32-bit signed integers.
• Monitor and restrict local access to the vulnerable decoder to prevent exploitation since the attack vector is local.

Useful 0 Not Useful 0