CVE-2026-34588: OpenEXR OpenEXR Has A Signed 32-bit Vulnerability

Q: What is CVE-2026-34588?

CVE-2026-34588 is a security vulnerability in OpenEXR involving OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write under CWE-190: Integer Overflow or Wraparound.

Q: Which OpenEXR versions are affected?

Affected versions include releases prior to 3.2.7, 3.3.9, 3.4.9 across affected packages: OpenEXR.

Q: What version fixes CVE-2026-34588?

Upgrading to 3.2.7, 3.3.9, 3.4.9 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is OpenEXR affected?

Yes, OpenEXR is affected in releases prior to 3.2.7, 3.3.9, 3.4.9. Upgrade your dependency to 3.2.7, 3.3.9, 3.4.9 or later.

Q: What is the CVSS score of CVE-2026-34588?

CVE-2026-34588 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Q: What CWE is associated with CVE-2026-34588?

CVE-2026-34588 is classified under CWE-190: Integer Overflow or Wraparound (The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.).

Q: How can I check PyPI dependencies for CVE-2026-34588?

Run the dependency tree command: 'pip show OpenEXR'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-588r-cr5c-w6hf

CVSS 7.8

CWE-190 CWE-125 CWE-787

Published 2026-04-08

Advisory Summary

CVE-2026-34588 is a HIGH (CVSS 7.8) openexr has a signed 32-bit vulnerability (CWE-190: Integer Overflow or Wraparound) affecting OpenEXR libraries in the PyPI ecosystem. The issue involves openexr has a signed 32-bit overflow in piz decoder leads to oob read/write. Remediation is available by upgrading affected packages to version 3.2.7, 3.3.9, 3.4.9.

CVE-2026-34588 at a Glance

CVE Identifier CVE-2026-34588

GHSA Identifier GHSA-588r-cr5c-w6hf

Severity HIGH

CVSS v3.1 Base Score 7.8

CWE Classification CWE-190: Integer Overflow or Wraparound

Affected Product OpenEXR

Package Ecosystem PyPI

Published Date 2026-04-08

Last Updated 2026-04-08

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required Low (PR:L)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2026-34588

To remediate this vulnerability, upgrade all affected OpenEXR dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

OpenEXR fixed: 3.2.7

pip install OpenEXR>=3.2.7

OpenEXR fixed: 3.3.9

pip install OpenEXR>=3.3.9

OpenEXR fixed: 3.4.9

pip install OpenEXR>=3.4.9

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show OpenEXR

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-34588, inspect your installed packages using pip:

pip show OpenEXR

Analyze the terminal output to locate any version of OpenEXR in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.2.7), your application is affected.

Note: The pip show OpenEXR command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-190: Integer Overflow or Wraparound, where the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. this occurs when an integer value is incremented to a value that is too large to store in the associated representation. when this occurs, the value may become a very small or negative number. In OpenEXR, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Summary `internal_exr_undo_piz()` advances the working wavelet pointer with signed 32-bit arithmetic: ```c wavbuf += nx * ny * wcount; ``` Because `nx`, `ny`, and `wcount` are `int`, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. Tested on commit 7820b7e1b93405ba1d551c43a945018226b75bc5 ## Technical Details The vulnerable decode path is: 1. `internal_exr_undo_piz()` sets `wavbuf = decode->scratch_buffer_1`. 2. For each channel, it calls `wav_2D_decode (wavbuf + j, ...)`. 3. It then advances `wavbuf` with `wavbuf += nx * ny * wcount`. The overflow happens in step 3. Once `wavbuf` is wrapped, the next channel's wavelet decode runs on the wrong address. In the 14-bit wavelet path, `wdec14_4()` first reads: - `*px` - `*p10` - `*p01` - `*p11` and then writes back to the same locations: - `*px = ...` - `*p01 = ...` - `*p10 = ...` - `*p11 = ...` As a result, the bug is not just a crash-only invalid read. It is an out-of-bounds read/write condition. ## Reproduction [piz_scanline_redzone.zip](https://github.com/user-attachments/files/26318946/piz_scanline_redzone.zip) Build `exrcheck` with ASAN and run: ``` ❯ ./build-asan/bin/exrcheck /tmp/piz_scanline_redzone.exr file /tmp/piz_scanline_redzone.exr /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:373:19: runtime error: signed integer overflow: 134217724 * 32 cannot be represented in type 'int' ================================================================= ==1711239==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bedc3934700 at pc 0x7bf1f100f498 bp 0x7ffe032d8f00 sp 0x7ffe032d8ef0 READ of size 2 at 0x7bedc3934700 thread T0 #0 0x7bf1f100f497 in wdec14_4 /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:148 #1 0x7bf1f100f497 in wav_2D_decode /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:403 #2 0x7bf1f100f497 in internal_exr_undo_piz /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:727 #3 0x7bf1f115b038 in exr_uncompress_chunk /home/pop/sec/openexr/src/lib/OpenEXRCore/compression.c:546 #4 0x7bf1f1161168 in exr_decoding_run /home/pop/sec/openexr/src/lib/OpenEXRCore/decoding.c:580 #5 0x7bf1f2a71add in run_decode /home/pop/sec/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:586 #6 0x7bf1f2a83dc4 in Imf_4_0::ScanLineInputFile::Data::readPixels(Imf_4_0::FrameBuffer const&, int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:500 #7 0x7bf1f28c6a81 in Imf_4_0::InputFile::Data::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfInputFile.cpp:458 #8 0x7bf1f3bfe2dc in readScanline<Imf_4_0::InputPart> /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:239 #9 0x7bf1f3c05b04 in readMultiPart /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:905 #10 0x7bf1f3c126fd in runChecks<char const*> /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1171 #11 0x7bf1f3c146b9 in Imf_4_0::checkOpenEXRFile(char const*, bool, bool, bool) /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1835 #12 0x5d9675fce8f8 in exrCheck(char const*, bool, bool, bool, bool) /home/pop/sec/openexr/src/bin/exrcheck/main.cpp:96 #13 0x5d9675fcb2b1 in main /home/pop/sec/openexr/src/bin/exrcheck/main.cpp:164 #14 0x7bf1efe2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #15 0x7bf1efe2a28a in __libc_start_main_impl ../csu/libc-start.c:360 #16 0x5d9675fcc844 in _start (/home/pop/sec/openexr/build-asan/bin/exrcheck+0xe844) (BuildId: 087c972343a5372940c42c0a2e7bce4a84288aec) 0x7bedc3934700 is located 256 bytes before 8590720784-byte region [0x7bedc3934800,0x7befc39f4710) allocated by thread T0 here: #0 0x7bf1f40fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7bf1f115883e in internal_decode_alloc_buffer /home/pop/sec/openexr/src/lib/OpenEXRCore/coding.c:256 #2 0x7bf1f100da97 in internal_exr_undo_piz /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:643 #3 0x7bf1f115b038 in exr_uncompress_chunk /home/pop/sec/openexr/src/lib/OpenEXRCore/compression.c:546 #4 0x7bf1f1161168 in exr_decoding_run /home/pop/sec/openexr/src/lib/OpenEXRCore/decoding.c:580 #5 0x7bf1f2a71add in run_decode /home/pop/sec/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:586 #6 0x7bf1f2a83dc4 in Imf_4_0::ScanLineInputFile::Data::readPixels(Imf_4_0::FrameBuffer const&, int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:500 #7 0x7bf1f28c6a81 in Imf_4_0::InputFile::Data::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfInputFile.cpp:458 #8 0x7bf1f3bfe2dc in readScanline<Imf_4_0::InputPart> /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:239 #9 0x7bf1f3c05b04 in readMultiPart /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:905 #10 0x7bf1f3c126fd in runChecks<char const*> /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1171 #11 0x7bf1f3c146b9 in Imf_4_0::checkOpenEXRFile(char const*, bool, bool, bool) /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1835 #12 0x5d9675fce8f8 in exrCheck(char const*, bool, bool, bool, bool) /home/pop/sec/openexr/src/bin/exrcheck/main.cpp:96 #13 0x5d9675fcb2b1 in main /home/pop/sec/openexr/src/bin/exrcheck/main.cpp:164 #14 0x7bf1efe2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #15 0x7bf1efe2a28a in __libc_start_main_impl ../csu/libc-start.c:360 #16 0x5d9675fcc844 in _start (/home/pop/sec/openexr/build-asan/bin/exrcheck+0xe844) (BuildId: 087c972343a5372940c42c0a2e7bce4a84288aec) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:148 in wdec14_4 Shadow bytes around the buggy address: 0x7bedc3934480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7bedc3934500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7bedc3934580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7bedc3934600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7bedc3934680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x7bedc3934700:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7bedc3934780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7bedc3934800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7bedc3934880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7bedc3934900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7bedc3934980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1711239==ABORTING ``` To prove this is both READ and WRITE, we can also `memcheck` against non-ASAN release build: ```sh valgrind --tool=memcheck --leak-check=no --track-origins=no \ --error-limit=no --num-callers=20 \ ./build-relwithdebinfo/bin/exrcheck /tmp/piz_scanline_redzone.exr ``` Observed result: - `Invalid read of size 2` at [internal_piz.c:150](/home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c#L150) - `Invalid write of size 2` at [internal_piz.c:171](/home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c#L171) This confirms the bug is an OOB read/write, not only a read-first crash. ### Redzone-Oriented File - width: `67108862` - height: `32` - channel A: `FLOAT`, sampling `1 x 1` - channel B: `HALF`, sampling `33554431 x 16` This makes: ```text width * 32 * 2 = 4294967168 ``` which wraps signed 32-bit arithmetic to `-128`. That places the next `wavbuf` access just before the allocated buffer, producing a clean heap-overflow report. ## Impact A crafted EXR file can trigger out-of-bounds memory access during PIZ decompression. The primitive includes both invalid reads and invalid writes. Depending on allocator layout and surrounding memory, this could lead to process crash, memory corruption, or potentially stronger exploitation outcomes. ## Recommended Fix - compute channel span in 64-bit arithmetic - reject any overflow in `nx * ny * wcount` - validate cumulative per-channel decoded footprint against `outsz` before wavelet decode - fail decompression if channel-derived layout does not exactly fit the decompression buffer -------- Found by: Quang Luong of Calif.io

CVE-2026-34588 Affected OpenEXR Versions

3 component(s)

Fixed Versions:

3.2.73.3.93.4.9

Product / Package	Ecosystem	Affected Versions	Fixed Version
OpenEXR pypi/OpenEXR	PyPI	≥ 3.1.0 < 3.2.7	3.2.7
OpenEXR pypi/OpenEXR	PyPI	≥ 3.3.0 < 3.3.9	3.3.9
OpenEXR pypi/OpenEXR	PyPI	≥ 3.4.0 < 3.4.9	3.4.9

References

GitHub Advisory / Wiki ADVISORY

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf

NVD — CVE-2026-34588 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-34588

OpenEXR Source Repository REPOSITORY

https://github.com/AcademySoftwareFoundation/openexr

OpenEXR Release RELEASE

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.7

OpenEXR Release RELEASE

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.9

OpenEXR Release RELEASE

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9

Frequently Asked Questions

What is CVE-2026-34588?

CVE-2026-34588 is a security vulnerability in OpenEXR involving OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write under CWE-190: Integer Overflow or Wraparound.

Which OpenEXR versions are affected?

Affected versions include releases prior to 3.2.7, 3.3.9, 3.4.9 across affected packages: OpenEXR.

What version fixes CVE-2026-34588?

Upgrading to 3.2.7, 3.3.9, 3.4.9 (or the latest patched release for your respective branch) resolves the vulnerability.

Is OpenEXR affected?

Yes, OpenEXR is affected in releases prior to 3.2.7, 3.3.9, 3.4.9. Upgrade your dependency to 3.2.7, 3.3.9, 3.4.9 or later.

What is the CVSS score of CVE-2026-34588?

CVE-2026-34588 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

What CWE is associated with CVE-2026-34588?

CVE-2026-34588 is classified under CWE-190: Integer Overflow or Wraparound (The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.).

How can I check PyPI dependencies for CVE-2026-34588?

Run the dependency tree command: 'pip show OpenEXR'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-588r-cr5c-w6hf",
  "modified" : "2026-04-08T15:09:01Z",
  "published" : "2026-04-08T15:09:01Z",
  "aliases" : [ "CVE-2026-34588" ],
  "summary" : "OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write",
  "details" : "## Summary\n\n`internal_exr_undo_piz()` advances the working wavelet pointer with signed 32-bit arithmetic:\n\n```c\nwavbuf += nx * ny * wcount;\n```\n\nBecause `nx`, `ny`, and `wcount` are `int`, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes.\n\nTested on commit 7820b7e1b93405ba1d551c43a945018226b75bc5\n\n## Technical Details\n\nThe vulnerable decode path is:\n\n1. `internal_exr_undo_piz()` sets `wavbuf = decode->scratch_buffer_1`.\n2. For each channel, it calls `wav_2D_decode (wavbuf + j, ...)`.\n3. It then advances `wavbuf` with `wavbuf += nx * ny * wcount`.\n\nThe overflow happens in step 3. Once `wavbuf` is wrapped, the next channel's wavelet decode runs on the wrong address.\n\nIn the 14-bit wavelet path, `wdec14_4()` first reads:\n\n- `*px`\n- `*p10`\n- `*p01`\n- `*p11`\n\nand then writes back to the same locations:\n\n- `*px  = ...`\n- `*p01 = ...`\n- `*p10 = ...`\n- `*p11 = ...`\n\nAs a result, the bug is not just a crash-only invalid read. It is an out-of-bounds read/write condition.\n\n## Reproduction\n\n[piz_scanline_redzone.zip](https://github.com/user-attachments/files/26318946/piz_scanline_redzone.zip)\n\nBuild `exrcheck` with ASAN and run:\n\n```\n❯ ./build-asan/bin/exrcheck /tmp/piz_scanline_redzone.exr\n file /tmp/piz_scanline_redzone.exr /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:373:19: runtime error: signed integer overflow: 134217724 * 32 cannot be represented in type 'int'\n=================================================================\n==1711239==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bedc3934700 at pc 0x7bf1f100f498 bp 0x7ffe032d8f00 sp 0x7ffe032d8ef0\nREAD of size 2 at 0x7bedc3934700 thread T0\n    #0 0x7bf1f100f497 in wdec14_4 /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:148\n    #1 0x7bf1f100f497 in wav_2D_decode /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:403\n    #2 0x7bf1f100f497 in internal_exr_undo_piz /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:727\n    #3 0x7bf1f115b038 in exr_uncompress_chunk /home/pop/sec/openexr/src/lib/OpenEXRCore/compression.c:546\n    #4 0x7bf1f1161168 in exr_decoding_run /home/pop/sec/openexr/src/lib/OpenEXRCore/decoding.c:580\n    #5 0x7bf1f2a71add in run_decode /home/pop/sec/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:586\n    #6 0x7bf1f2a83dc4 in Imf_4_0::ScanLineInputFile::Data::readPixels(Imf_4_0::FrameBuffer const&, int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:500\n    #7 0x7bf1f28c6a81 in Imf_4_0::InputFile::Data::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfInputFile.cpp:458\n    #8 0x7bf1f3bfe2dc in readScanline<Imf_4_0::InputPart> /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:239\n    #9 0x7bf1f3c05b04 in readMultiPart /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:905\n    #10 0x7bf1f3c126fd in runChecks<char const*> /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1171\n    #11 0x7bf1f3c146b9 in Imf_4_0::checkOpenEXRFile(char const*, bool, bool, bool) /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1835\n    #12 0x5d9675fce8f8 in exrCheck(char const*, bool, bool, bool, bool) /home/pop/sec/openexr/src/bin/exrcheck/main.cpp:96\n    #13 0x5d9675fcb2b1 in main /home/pop/sec/openexr/src/bin/exrcheck/main.cpp:164\n    #14 0x7bf1efe2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #15 0x7bf1efe2a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #16 0x5d9675fcc844 in _start (/home/pop/sec/openexr/build-asan/bin/exrcheck+0xe844) (BuildId: 087c972343a5372940c42c0a2e7bce4a84288aec)\n\n0x7bedc3934700 is located 256 bytes before 8590720784-byte region [0x7bedc3934800,0x7befc39f4710)\nallocated by thread T0 here:\n    #0 0x7bf1f40fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69\n    #1 0x7bf1f115883e in internal_decode_alloc_buffer /home/pop/sec/openexr/src/lib/OpenEXRCore/coding.c:256\n    #2 0x7bf1f100da97 in internal_exr_undo_piz /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:643\n    #3 0x7bf1f115b038 in exr_uncompress_chunk /home/pop/sec/openexr/src/lib/OpenEXRCore/compression.c:546\n    #4 0x7bf1f1161168 in exr_decoding_run /home/pop/sec/openexr/src/lib/OpenEXRCore/decoding.c:580\n    #5 0x7bf1f2a71add in run_decode /home/pop/sec/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:586\n    #6 0x7bf1f2a83dc4 in Imf_4_0::ScanLineInputFile::Data::readPixels(Imf_4_0::FrameBuffer const&, int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:500\n    #7 0x7bf1f28c6a81 in Imf_4_0::InputFile::Data::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfInputFile.cpp:458\n    #8 0x7bf1f3bfe2dc in readScanline<Imf_4_0::InputPart> /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:239\n    #9 0x7bf1f3c05b04 in readMultiPart /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:905\n    #10 0x7bf1f3c126fd in runChecks<char const*> /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1171\n    #11 0x7bf1f3c146b9 in Imf_4_0::checkOpenEXRFile(char const*, bool, bool, bool) /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1835\n    #12 0x5d9675fce8f8 in exrCheck(char const*, bool, bool, bool, bool) /home/pop/sec/openexr/src/bin/exrcheck/main.cpp:96\n    #13 0x5d9675fcb2b1 in main /home/pop/sec/openexr/src/bin/exrcheck/main.cpp:164\n    #14 0x7bf1efe2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #15 0x7bf1efe2a28a in __libc_start_main_impl ../csu/libc-start.c:360\n    #16 0x5d9675fcc844 in _start (/home/pop/sec/openexr/build-asan/bin/exrcheck+0xe844) (BuildId: 087c972343a5372940c42c0a2e7bce4a84288aec)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:148 in wdec14_4\nShadow bytes around the buggy address:\n  0x7bedc3934480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7bedc3934500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7bedc3934580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7bedc3934600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7bedc3934680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x7bedc3934700:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7bedc3934780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7bedc3934800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7bedc3934880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7bedc3934900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7bedc3934980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07\n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==1711239==ABORTING\n```\n\nTo prove this is both READ and WRITE, we can also `memcheck` against non-ASAN release build:\n\n```sh\nvalgrind --tool=memcheck --leak-check=no --track-origins=no \\\n  --error-limit=no --num-callers=20 \\\n  ./build-relwithdebinfo/bin/exrcheck /tmp/piz_scanline_redzone.exr\n```\n\nObserved result:\n\n- `Invalid read of size 2` at [internal_piz.c:150](/home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c#L150)\n- `Invalid write of size 2` at [internal_piz.c:171](/home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c#L171)\n\nThis confirms the bug is an OOB read/write, not only a read-first crash.\n\n### Redzone-Oriented File\n\n- width: `67108862`\n- height: `32`\n- channel A: `FLOAT`, sampling `1 x 1`\n- channel B: `HALF`, sampling `33554431 x 16`\n\nThis makes:\n\n```text\nwidth * 32 * 2 = 4294967168\n```\n\nwhich wraps signed 32-bit arithmetic to `-128`.\n\nThat places the next `wavbuf` access just before the allocated buffer, producing a clean heap-overflow report.\n\n## Impact\n\nA crafted EXR file can trigger out-of-bounds memory access during PIZ decompression. The primitive includes both invalid reads and invalid writes. Depending on allocator layout and surrounding memory, this could lead to process crash, memory corruption, or potentially stronger exploitation outcomes.\n\n## Recommended Fix\n\n- compute channel span in 64-bit arithmetic\n- reject any overflow in `nx * ny * wcount`\n- validate cumulative per-channel decoded footprint against `outsz` before wavelet decode\n- fail decompression if channel-derived layout does not exactly fit the decompression buffer\n--------\nFound by: Quang Luong of Calif.io",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "OpenEXR"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.1.0"
      }, {
        "fixed" : "3.2.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "OpenEXR"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.3.0"
      }, {
        "fixed" : "3.3.9"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "OpenEXR"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.4.0"
      }, {
        "fixed" : "3.4.9"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-34588"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/AcademySoftwareFoundation/openexr"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125", "CWE-190", "CWE-787" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-08T15:09:01Z",
    "nvd_published_at" : "2026-04-06T16:16:35Z"
  }
}

CVSS V3

7.8 HIGH

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required Low (PR:L)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Advisory Metadata

Source ID: GHSA-588r-cr5c-w6hf
Schema Version: 1.4.0
Published: 2026-04-08 15:09
Last Modified: 2026-04-08 15:09
Database Record File: advisories/github-reviewed/2026/04/GHSA-588r-cr5c-w6hf/GHSA-588r-cr5c-w6hf.json