CVE-2026-34589

CVE-2026-34589 is a buffer overflow vulnerability affecting OpenEXR versions 3.2.0 through 3.2.6, 3.3.0 through 3.3.8, and 3.4.0 through 3.4.8. The DWA lossy decoder incorrectly uses signed 32-bit arithmetic when constructing temporary block pointers, causing integer overflow on large image widths. This results in out-of-bounds memory writes to the rowBlock backing store. The vulnerability has been patched in versions 3.2.7, 3.3.9, and 3.4.9. The vulnerability carries a CVSS 3.1 score of 5.0 (Medium severity) and requires local access with low attack complexity and user interaction. An attacker must be able to supply a specially crafted EXR file to a local user. While the vulnerability does not compromise confidentiality or integrity, it can cause high-impact denial of service by corrupting memory and crashing the application. There is no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and has received minimal community attention, with an extremely low EPSS score of 0.000090. Organizations should prioritize patching based on their use of OpenEXR in production environments, but this is not an urgent threat requiring immediate remediation.