CVE-2026-34588

CVE-2026-34588 is a signed integer overflow vulnerability in OpenEXR, the motion picture industry standard image file format, affecting versions 3.1.0 through 3.2.6, 3.3.0-3.3.8, and 3.4.0-3.4.8. The flaw exists in the internal_exr_undo_piz() function where signed 32-bit arithmetic on wavelet pointer calculations can overflow, causing subsequent channel decoding to read from and write to incorrect memory addresses, resulting in both out-of-bounds reads and writes. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector requiring low privilege but no user interaction. The impact is severe, affecting confidentiality, integrity, and availability with high severity across all three dimensions. An attacker with local access could exploit a maliciously crafted EXR file to leak sensitive information, corrupt data, or cause a denial of service. There is no evidence of active exploitation in the wild, with an exceptionally low EPSS score of 0.000090000 indicating minimal real-world attack probability. The vulnerability does not appear on the CISA KEV catalog and is currently inactive on vulnerability hot lists, suggesting limited community exploitation activity. Security patches are available in OpenEXR versions 3.2.7, 3.3.9, and 3.4.9, which affected organizations should prioritize deploying.