CVE-2026-34378

Name	CVE-2026-34378
Description	OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overflow in generic_unpack(). By setting dataWindow.min.x to a large negative value, OpenEXRCore computes an enormous image width, which is later used in a signed integer multiplication that overflows, causing the process to terminate with SIGILL via UBSan. This vulnerability is fixed in 3.4.9.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openexr (PTS)	bullseye (security), bullseye	2.5.4-2+deb11u1	vulnerable
	bookworm	3.1.5-5	fixed
	trixie	3.1.13-2	fixed
	forky, sid	3.4.6+ds-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
openexr	source	bookworm	(not affected)
openexr	source	trixie	(not affected)
openexr	source	(unstable)	(unfixed)

Notes

[trixie] - openexr <not-affected> (Vulnerable code not present)
[bookworm] - openexr <not-affected> (Vulnerable code not present)
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v76p-4qvv-vh4g
https://github.com/AcademySoftwareFoundation/openexr/pull/2321
https://github.com/AcademySoftwareFoundation/openexr/commit/088859fb6199e56824c4c9ed60afc825261bfea9 (main)
https://github.com/AcademySoftwareFoundation/openexr/commit/7a1c64ca74d12bf5f64a912d4e12a651689f8652 (v3.4.9-rc)