EUVD-2026-19347

OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write through the internalexrundopiz process. An attacker can cause out-of-bounds memory access, leading to potential memory corruption or process crash, by supplying a specially crafted EXR file that triggers signed integ...

CVE-2026-34543 vulnerabilities

Vulnerabilities for packages: openexr...

CVE-2026-34544 vulnerabilities

Vulnerabilities for packages: openexr...

CVE-2026-34545 vulnerabilities

Vulnerabilities for packages: openexr...

GHSA-VC68-257W-M432 vulnerabilities

Vulnerabilities for packages: openexr...

GHSA-H762-RHV3-H25V vulnerabilities

Vulnerabilities for packages: openexr...

SUSE CVE-2026-34378

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overfl...

SUSE CVE-2026-34379

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a misaligned memory write vulnerability exists in LossyDctDecoderexecute in...

SUSE CVE-2026-34380

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a signed integer overflow exists in undopxr24impl in src/lib/OpenEXRCore/internalpxr24.c at line 377. The...

SUSE CVE-2026-34588

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internalexrundopiz advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and...

SUSE CVE-2026-34589

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, the DWA lossy decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. Fo...

CVE-2026-34545 vulnerabilities

Vulnerabilities for packages: openexr...

CVE-2026-34543 vulnerabilities

Vulnerabilities for packages: openexr...

GHSA-VC68-257W-M432 vulnerabilities

Vulnerabilities for packages: openexr...

GHSA-H762-RHV3-H25V vulnerabilities

Vulnerabilities for packages: openexr...

CVE-2026-34544 vulnerabilities

Vulnerabilities for packages: openexr...

GHSA-Q6VJ-WXVF-5M8C vulnerabilities

Vulnerabilities for packages: openexr...

GHSA-Q6VJ-WXVF-5M8C vulnerabilities

Vulnerabilities for packages: openexr...

CVE-2026-34588

A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker could exploit an integer overflow vulnerability in the internalexrundopiz function by providing a specially crafted EXR file. This flaw leads to out-of-bounds reads and writes, which may allow...