CVE-2026-27622: OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-03 · updated 2026-07-15
Weakness: CWE-787

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.

Affected products

AcademySoftwareFoundation openexr: before 3.2.6; from 3.3.0 before 3.3.8; from 3.4.0 before 3.4.6 — fixed in 3.2.6, 3.3.8, 3.4.6

How to fix

Upgrade to a fixed version: AcademySoftwareFoundation openexr 3.2.6, 3.3.8, 3.4.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-27622 or the next vulnerability affects your stack