CVE-2026-34379

OVERVIEW CVE-2026-34379 is a misaligned memory write vulnerability in OpenEXR versions 3.2.0 through 3.2.6, 3.3.0 through 3.3.8, and 3.4.0 through 3.4.8. The flaw exists in the LossyDctDecoder_execute() function when processing DWA or DWAB-compressed EXR image files containing FLOAT-type channels. The decoder improperly casts an unaligned pointer to perform in-place HALF to FLOAT conversion, violating C standard alignment requirements. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.1 (HIGH) with network-based attack vector, low complexity, and no authentication required. User interaction is necessary, as exploitation requires opening a malicious EXR file. The impact includes data integrity compromise and availability disruption. Exploitation manifests as immediate crashes on alignment-enforcing architectures such as ARM and RISC-V, while x86 systems remain silently vulnerable to compiler optimization-based attacks. EXPLOITATION STATUS CVE-2026-34379 is not currently listed as actively exploited in CISA's Known Exploited Vulnerabilities catalog, and community attention remains low as indicated by its modest FAUCET Risk Score of 46.0. The vulnerability has been remediated in OpenEXR versions 3.2.7, 3.3.9, and 3.4.9. Organizations using affected versions should prioritize patching, particularly those processing untrusted EXR files in production environments.