CVE-2026-34588 json
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
published 2026-04-06 7 mo ago modified 2026-10-26 13 d ago also EUVD-2026-19347 , GHSA-588r-cr5c-w6hf , JLSEC-2026-148 , PYSEC-2026-2845
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
Patch / fix
- pypi openexr 3.2.7, 3.3.9, 3.4.9
- julia OpenEXR_jll 3.4.9+0
- Red Hat Red Hat Enterprise Linux 10 0:3.1.10-8.el10_1.2, 0:3.1.10-8.el10_2.2
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.1.10-8.el10_0.2
- Red Hat Red Hat Enterprise Linux 9 0:3.1.1-3.el9_7.2, 0:3.1.1-3.el9_8.2
- Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:3.1.1-2.el9_0.3
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:3.1.1-2.el9_2.3
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:3.1.1-2.el9_4.3
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.1.1-3.el9_6.2
- Red Hat Red Hat AI Inference Server 3.3 1782352847, 1782352919, 1782352950, 1782353093
- openexr Debian 14 3.4.14-0.1
debian advisories DEBIAN-CVE-2026-34588
- openexr Ubuntu Pro 24.04 LTS 3.1.5-5.1ubuntu0.1~esm1
- openexr Ubuntu Pro 26.04 LTS 3.1.13-2ubuntu0.26.04.1~esm1
ubuntu advisories UBUNTU-CVE-2026-34588
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- openexr RHEL 9 3.1.1-3.el9_8.2
- openexr-libs RHEL 9 3.1.1-3.el9_8.2
- openexr RHEL 10.2 3.1.10-8.el10_2.2
- openexr-libs RHEL 10.2 3.1.10-8.el10_2.2
- openexr RHEL 10.1 3.1.10-8.el10_1.2
- openexr-libs RHEL 10.1 3.1.10-8.el10_1.2
- openexr RHEL 9 3.1.1-3.el9_7.2
- openexr-libs RHEL 9 3.1.1-3.el9_7.2
red hat advisories RHSA-2026:19587RHSA-2026:19359RHSA-2026:19146RHSA-2026:17660RHSA-2026:17659RHSA-2026:17658
- openexr openSUSE Leap 16.0 3.2.2-160000.6.1
- openexr openSUSE Tumbleweed 3.4.9-1.1
opensuse advisories openSUSE-SU-2026:20605-1openSUSE-SU-2026:10505-1
- openexr AlmaLinux 10 3.1.10-8.el10_2.2
- openexr-libs AlmaLinux 10 3.1.10-8.el10_2.2
- openexr AlmaLinux 9 3.1.1-3.el9_8.2
- openexr-libs AlmaLinux 9 3.1.1-3.el9_8.2
- openexr AlmaLinux 9 3.1.1-3.el9_7.2
- openexr-libs AlmaLinux 9 3.1.1-3.el9_7.2
- openexr AlmaLinux 10 3.1.10-8.el10_1.2
- openexr-libs AlmaLinux 10 3.1.10-8.el10_1.2
almalinux advisories ALSA-2026:19146ALSA-2026:19359ALSA-2026:15887ALSA-2026:15888
- openexr Rocky Linux 10 3.1.10-8.el10_2.2
- openexr Rocky Linux 9 3.1.1-3.el9_7.2
- openexr Rocky Linux 10 3.1.10-8.el10_1.2
rocky linux advisories RLSA-2026:19146RLSA-2026:19359RLSA-2026:15888RLSA-2026:15887
- openexr Alpine 3.22 3.3.11-r0
- openexr Alpine 3.23 3.4.13-r0
- openexr Alpine 3.24 3.4.10-r0
alpine advisories ALPINE-CVE-2026-34588
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-34588 updated cvss 8.8
OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file
-
Red Hat Enterprise Linux 6 OpenEXR, OpenEXR-libs Red Hat Enterprise Linux 7 OpenEXR, OpenEXR-libsaffected: workaround, no fix planned “Out of support scope”
-
Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1782352847, rhaiis/vllm-rocm-rhel9 1782353093, rhaiis/vllm-spyre-rhel9 1782352919, rhaiis/model-opt-cuda-rhel9 1782352950fixed: vendor fix RHSA-2026:30078
-
Red Hat CodeReady Linux Builder EUS (v.9.4) openexr-devel 3.1.1-2.el9_4.3, openexr-debuginfo 3.1.1-2.el9_4.3, openexr-debugsource 3.1.1-2.el9_4.3, openexr-libs-debuginfo 3.1.1-2.el9_4.3fixed: vendor fix RHSA-2026:17658
-
Red Hat CodeReady Linux Builder EUS (v.9.6) openexr-devel 3.1.1-3.el9_6.2, openexr-debuginfo 3.1.1-3.el9_6.2, openexr-debugsource 3.1.1-3.el9_6.2, openexr-libs-debuginfo 3.1.1-3.el9_6.2fixed: vendor fix RHSA-2026:17660
-
Red Hat Enterprise Linux AppStream (v. 9) openexr 3.1.1-3.el9_7.2, openexr 3.1.1-3.el9_8.2, openexr-libs 3.1.1-3.el9_7.2, openexr-libs 3.1.1-3.el9_8.2fixed: vendor fix RHSA-2026:15887
-
Red Hat Enterprise Linux AppStream (v. 10) openexr 3.1.10-8.el10_1.2, openexr 3.1.10-8.el10_2.2, openexr-libs 3.1.10-8.el10_1.2, openexr-libs 3.1.10-8.el10_2.2fixed: vendor fix RHSA-2026:15888
-
Red Hat Enterprise Linux AppStream E4S (v.9.0) openexr 3.1.1-2.el9_0.3, openexr-libs 3.1.1-2.el9_0.3fixed: vendor fix RHSA-2026:19587
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) openexr 3.1.1-2.el9_2.3, openexr-libs 3.1.1-2.el9_2.3fixed: vendor fix RHSA-2026:17659
show 8 moreshow fewer
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) openexr 3.1.10-8.el10_0.2, openexr-libs 3.1.10-8.el10_0.2fixed: vendor fix RHSA-2026:17656
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) openexr 3.1.1-2.el9_4.3, openexr-libs 3.1.1-2.el9_4.3fixed: vendor fix RHSA-2026:17658
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) openexr 3.1.1-3.el9_6.2, openexr-libs 3.1.1-3.el9_6.2fixed: vendor fix RHSA-2026:17660
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) openexr-devel 3.1.1-3.el9_7.2, openexr-devel 3.1.1-3.el9_8.2, openexr-debuginfo 3.1.1-3.el9_7.2, openexr-debuginfo 3.1.1-3.el9_8.2, openexr-debugsource 3.1.1-3.el9_7.2, openexr-debugsource 3.1.1-3.el9_8.2, +2 morefixed: vendor fix RHSA-2026:15887
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) openexr-devel 3.1.10-8.el10_1.2, openexr-devel 3.1.10-8.el10_2.2, openexr-debuginfo 3.1.10-8.el10_1.2, openexr-debuginfo 3.1.10-8.el10_2.2, openexr-debugsource 3.1.10-8.el10_1.2, openexr-debugsource 3.1.10-8.el10_2.2, +2 morefixed: vendor fix RHSA-2026:15888
-
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) openexr-devel 3.1.10-8.el10_0.2, openexr-debuginfo 3.1.10-8.el10_0.2, openexr-debugsource 3.1.10-8.el10_0.2, openexr-libs-debuginfo 3.1.10-8.el10_0.2fixed: vendor fix RHSA-2026:17656
-
Red Hat OpenShift AI 3.4 rhai/base-image-neuron-rhel9 1790703542fixed: vendor fix RHSA-2026:74674
-
Red Hat Enterprise Linux 8 OpenEXR, OpenEXR-libsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | openexr | >=3.1.0, <3.2.7 >=3.3.0, <3.3.9 >=3.4.0, <3.4.9 |
3.2.7 3.3.9 3.4.9 |
| julia | OpenEXR_jll | >=3.1.1+0, <3.4.9+0 |
3.4.9+0 |
Affected products
- AcademySoftwareFoundation openexr
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
- Red Hat Red Hat AI Inference Server 3.3
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
Classification
References
-
github.com
/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf
web, exploit, mitigation, vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:17656
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:15888
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:19146
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:19587
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:17659
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:17658
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:17660
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:15887
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:19359
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:30078
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:30089
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:30088
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:30087
vendor-advisory, web
-
github.com
/AcademySoftwareFoundation/openexr/releases/tag/v3.2.7
web, product, release-notes
-
github.com
/AcademySoftwareFoundation/openexr/releases/tag/v3.3.9
web, product, release-notes
-
github.com
/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9
web, product, release-notes
-
access.redhat.com
/security/cve/CVE-2026-34588
vdb-entry, web
-
bugzilla.redhat.com
/show_bug.cgi?id=2455408
issue-tracking, web
-
security.access.redhat.com
/data/csaf/v2/vex/2026/cve-2026-34588.json
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-34588
advisory
-
github.com
/AcademySoftwareFoundation/openexr
package
-
pypi.org
/project/openexr
package
-
github.com
/advisories/GHSA-588r-cr5c-w6hf
advisory
Sources
- CVE List CVE-2026-34588
- GitHub Advisory GHSA-588r-cr5c-w6hf
- NVD CVE-2026-34588
- OSV JLSEC-2026-148
- OSV PYSEC-2026-2845
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.