Skip to content
OpenAdvisories
High · 8.4 CVE-2026-40244 EUVD-2026-24046

OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)

Published Apr 21, 2026 · Updated Jul 15, 2026 · Assigned by GitHub_M

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, `internal_dwa_compressor.h:1722` performs `curc->width * curc->height` in `int32` arithmetic without a `(size_t)` cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses `internal_dwa_compressor.h:1722`.

Affected products

VendorProductAffectedFixed
AcademySoftwareFoundation openexr >= 3.2.0, < 3.2.8, >= 3.3.0, < 3.3.10, >= 3.4.0, < 3.4.10 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 openexr 3.4.14-0.1 —
Debian 13 openexr 3.2.12-1~deb13u1 —
Debian 12 openexr No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 openexr No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed openexr 3.4.9-4.1 openSUSE-SU-2026:10665-1
ReleasePackageFixed inAdvisory
Alpine v3.24 openexr 3.4.10-r0 —
Alpine v3.23 openexr 3.4.13-r0 —
Alpine v3.22 openexr 3.3.11-r0 —

Advisories 1

References