CVE-2026-27622 — Out-of-bounds Write in Openexr

Vendor	Product	Version range	Fixed in
academysoftwarefoundation	openexr	—	—
academysoftwarefoundation	openexr	—	—
academysoftwarefoundation	openexr	—	—
debian	openexr	< openexr 3.4.6+ds-1 (forky)	openexr 3.4.6+ds-1 (forky)
openexr	openexr	< 3.2.6	3.2.6
openexr	openexr	>= 0 < 3.4.6+ds-1	3.4.6+ds-1
openexr	openexr	>= 2.3.0 < 3.2.6	3.2.6
openexr	openexr	>= 3.3.0 < 3.3.8	3.3.8
openexr	openexr	>= 3.3.0 < 3.3.8	3.3.8
openexr	openexr	>= 3.4.0 < 3.4.6	3.4.6
openexr	openexr	>= 3.4.0 < 3.4.6	3.4.6
ubuntu	openexr	—	—

VulDB

AcademySoftwareFoundation OpenEXR up to 3.2.5/3.3.7/3.4.5 EXR File Parser readPixels out-of-bounds write (GHSA-cr4v-6jm6-4963 / Nessus ID 301138)

vuldb·2026-04-13·CVSS 8.4

CVE-2026-27622 [HIGH] AcademySoftwareFoundation OpenEXR up to 3.2.5/3.3.7/3.4.5 EXR File Parser readPixels out-of-bounds write (GHSA-cr4v-6jm6-4963 / Nessus ID 301138) A vulnerability, which was classified as critical, was found in AcademySoftwareFoundation OpenEXR up to 3.2.5/3.3.7/3.4.5. Affected is the function CompositeDeepScanLine::readPixels of the component EXR File Parser. Such manipulation leads to out-of-bounds write. This vulnerability is traded as CVE-2026-27622. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

OSV

CVE-2026-27622: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry

osv·2026-03-03·CVSS 8.4

CVE-2026-27622 [HIGH] CVE-2026-27622: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.

OSV

OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write

osv·2026-03-02

CVE-2026-27622 [HIGH] OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write ## Summary Function: `CompositeDeepScanLine::readPixels`, reachable from high-level multipart deep read flows (`MultiPartInputFile` + `DeepScanLineInputPart` + `CompositeDeepScanLine`). Vulnerable lines (`src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp`): - `total_sizes[ptr] += counts[j][ptr];` (line ~511) - `overall_sample_count += total_sizes[ptr];` (line ~514) - `samples[channel].resize (overall_sample_count);` (line ~535) Impact: 32-bit sample-count accumulation wrap leads to undersized allocation, then decode writes with true sample volume, causing heap OOB write in `generic_unpack_deep_pointers` (`src/lib/OpenEXRCore/unpack.c:1374`) (DoS/Crash, memory corruption/RCE). Attack scenario: - Attacker provides multi

GHSA

OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write

ghsa·2026-03-02

CVE-2026-27622 [HIGH] CWE-787 OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write ## Summary Function: `CompositeDeepScanLine::readPixels`, reachable from high-level multipart deep read flows (`MultiPartInputFile` + `DeepScanLineInputPart` + `CompositeDeepScanLine`). Vulnerable lines (`src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp`): - `total_sizes[ptr] += counts[j][ptr];` (line ~511) - `overall_sample_count += total_sizes[ptr];` (line ~514) - `samples[channel].resize (overall_sample_count);` (line ~535) Impact: 32-bit sample-count accumulation wrap leads to undersized allocation, then decode writes with true sample volume, causing heap OOB write in `generic_unpack_deep_pointers` (`src/lib/OpenEXRCore/unpack.c:1374`) (DoS/Crash, memory corruption/RCE). Attack scenario: - Attacker provides multi

Ubuntu

OpenEXR vulnerabilities

vendor_ubuntu·2026-05-07·CVSS 8.4

CVE-2026-27622 [HIGH] OpenEXR vulnerabilities Title: OpenEXR vulnerabilities Summary: Several security issues were fixed in OpenEXR. Quang Luong discovered that OpenEXR incorrectly handled sample count accumulation when processing deep scan line image files. An attacker could possibly use this issue to cause OpenEXR to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-27622) It was discovered that OpenEXR had an integer overflow in the PXR24 decoder. An attacker could possibly use this issue to cause OpenEXR to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-34380) Quang Luong discovered that OpenEXR had a signed integer overflow in the PIZ decoder. An attacker could possibly use this issue to cause OpenEXR to

Red Hat

openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing

vendor_redhat·2026-03-03·CVSS 8.4

CVE-2026-27622 [HIGH] CWE-190 openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6. A flaw was found in Open

Debian

CVE-2026-27622: openexr - OpenEXR provides the specification and reference implementation of the EXR file ...

vendor_debian·2026·CVSS 8.4

CVE-2026-27622 [HIGH] CVE-2026-27622: openexr - OpenEXR provides the specification and reference implementation of the EXR file ... OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 3.4.6+ds-1) sid: resolved (fixed in 3.4.6+ds

CVE-2026-27622: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In…

Affected

CVSS provenance