What’s Vulnerable › Vulnerabilities

CVE-2026-34543: OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-01 · updated 2026-10-26
• Weakness: CWE-908

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, sensitive information from heap memory may be leaked through the decoded pixel data (information disclosure). This occurs under default settings; simply reading a malicious EXR file is sufficient to trigger the issue, without any user interaction. This issue has been patched in version 3.4.8.

Affected products

• AcademySoftwareFoundation openexr: from 3.2.0 before 3.2.7; from 3.3.0 before 3.3.9; from 3.4.0 before 3.4.8 — fixed in 3.2.7, 3.3.9, 3.4.8

How to fix

Upgrade to a fixed version: AcademySoftwareFoundation openexr 3.2.7, 3.3.9, 3.4.8. Check the vendor advisory for mitigations.

References

• https://github.com/AcademySoftwareFoundation/openexr/commit/5f6d0aaa9e43802917af7db90f181e88e083d3b8
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-vc68-257w-m432
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-vc68-257w-m432

Get alerted when CVE-2026-34543 or the next vulnerability affects your stack