Skip to content
Fencer Vulns
high 7.1

CVE-2026-34379 json

OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)

published 2026-04-06 7 mo ago modified 2026-10-26 13 d ago also EUVD-2026-19305 , JLSEC-2026-143

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a misaligned memory write vulnerability exists in LossyDctDecoder_execute() in src/lib/OpenEXRCore/internal_dwa_decoder.h:749. When decoding a DWA or DWAB-compressed EXR file containing a FLOAT-type channel, the decoder performs an in-place HALF→FLOAT conversion by casting an unaligned uint8_t * row pointer to float * and writing through it. Because the row buffer may not be 4-byte aligned, this constitutes undefined behavior under the C standard and crashes immediately on architectures that enforce alignment (ARM, RISC-V, etc.). On x86 it is silently tolerated at runtime but remains exploitable via compiler optimizations that assume aligned access. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.

Patch / fix

  • julia OpenEXR_jll 3.4.9+0
  • openexr openexr 3.2.7, 3.3.9, 3.4.9
  • openexr Debian 14 3.4.14-0.1

debian advisories DEBIAN-CVE-2026-34379

  • openexr openSUSE Leap 16.0 3.2.2-160000.6.1
  • openexr openSUSE Tumbleweed 3.4.9-1.1

opensuse advisories openSUSE-SU-2026:20605-1openSUSE-SU-2026:10505-1

  • openexr Alpine 3.22 3.3.11-r0
  • openexr Alpine 3.23 3.4.13-r0
  • openexr Alpine 3.24 3.4.10-r0

alpine advisories ALPINE-CVE-2026-34379

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-34379 updated cvss 7.1

OpenEXR: OpenEXR: Denial of Service due to misaligned memory write during EXR file decoding

  • Red Hat Enterprise Linux 6 OpenEXR, OpenEXR-libs Red Hat Enterprise Linux 7 OpenEXR, OpenEXR-libs
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 OpenEXR, OpenEXR-libs Red Hat Enterprise Linux 9 OpenEXR Red Hat Enterprise Linux 10 OpenEXR
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-w88v-vqhq-5p24 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CISA ADP 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
OSV 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Affected packages

ecosystem package affected fixed in
julia OpenEXR_jll
>=3.1.4+0, <3.4.9+0
3.4.9+0

Affected products

  • AcademySoftwareFoundation openexr
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-704 Incorrect Type Conversion or Cast
  • CWE-787 Out-of-bounds Write
  • CWE-843 Access of Resource Using Incompatible Type
  • CWE-475 Undefined Behavior for Input to API

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.