CVE-2026-34544— OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client ExecutionGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-34544
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
Source: CVE Program / CVE List V5
Vulnerability Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, a crafted B44 or B44A EXR file can cause an out-of-bounds write in any application that decodes it via exr_decoding_run(). Consequences range from immediate crash (most likely) to corruption of adjacent heap allocations (layout-dependent). This issue has been patched in version 3.4.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Vulnerability Title
OpenEXR 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenEXR是Academy Software Foundation开源的一种高动态范围图像（HDR）文件格式的开放标准。 OpenEXR 3.4.0至3.4.8之前版本存在缓冲区错误漏洞，该漏洞源于特制的B44或B44A EXR文件可能导致通过exr_decoding_run()解码它的任何应用程序发生越界写入，后果从立即崩溃到相邻堆分配损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.4.0, < 3.4.8 | - |
II. Public POCs for CVE-2026-34544
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34544
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-34544 (1)
Vendor Advisories for CVE-2026-34544 (1)
Vendor Pages for CVE-2026-34544 (1)
Same Patch Batch · AcademySoftwareFoundation · 2026-04-01 · 3 CVEs total
| CVE-2026-34543 | OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed siz | |
| CVE-2026-34545 | OpenEXR: integer overflow lead to OOB in HTJ2K decoder |
IV. Related Vulnerabilities
Same product: openexr
- CVE-2026-45696
OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl( - CVE-2026-44663
OpenEXR: Integer overflow in the HTJ2K decoder leads to heap - CVE-2026-42217
OpenEXR: Shift exponent overflow in `readVariableLengthInteg - CVE-2026-42216
OpenEXR: Out-of-bounds read in `IDManifest::init()` during p - CVE-2026-41142
OpenEXR is Vulnerable to Integer overflow in ImageChannel::r
Same vendor: AcademySoftwareFoundation
- CVE-2026-42450
OpenColorIO vulnerable to stack buffer overflow via unbounde - CVE-2026-45696
OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl( - CVE-2026-44663
OpenEXR: Integer overflow in the HTJ2K decoder leads to heap - CVE-2026-43903
OpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSE - CVE-2026-43904
OpenImageIO: Softimage PIC RLE decoder heap buffer overflow
Same weakness: CWE-190
- CVE-2026-66757
Gimp: signed integer overflow in file-sgi (sgi-lib) causes t - CVE-2026-66758
Gimp: integer overflow in file-fits plugin causes a heap-bas - CVE-2026-55969
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, - CVE-2026-16554
Integer Overflow Leading to Heap Buffer Overflow in cJSON - CVE-2026-16280
GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOff
V. Comments for CVE-2026-34544
No comments yet