CVE-2026-27622: OpenEXR Heap OOB Write Vulnerability Due to Integer Overflow
Summary
CVE-2026-27622: OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write. Affects openexr across 3 version ranges.
>= 2.3.0, < 3.2.6
>= 3.3.0, < 3.3.8
>= 3.4.0, < 3.4.6
Fixed in 3.2.6, 3.3.8 or 3.4.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenEXR is an open-source high dynamic range image file format developed by Industrial Light & Magic. It is widely used in visual effects and animation for its ability to store a vast amount of image data. The package supports various compression methods and is designed for efficient storage and manipulation of deep image data. However, it is vulnerable to a critical issue that can lead to heap out-of-bounds writes, potentially allowing attackers to exploit the system.
Vulnerability Detail
The vulnerability arises from an integer overflow in the CompositeDeepScanLine::readPixels function, which is part of the OpenEXR library. When processing multipart deep EXR files with large sample counts, the accumulation of sample counts can exceed the maximum value of a 32-bit unsigned integer, causing a wraparound. This results in an undersized memory allocation for the sample buffer, leading to heap out-of-bounds writes during decoding operations. The consequences of this vulnerability include denial of service (DoS), memory corruption, and potential remote code execution (RCE). The issue has been present since version 2.3.0 and affects multiple versions of the OpenEXR package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 3.2.63.2.6pip install --upgrade "openexr==3.2.6" -
>= 3.3.0, < 3.3.83.3.8pip install --upgrade "openexr==3.3.8" -
>= 3.4.0, < 3.4.63.4.6pip install --upgrade "openexr==3.4.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid processing multipart deep EXR files with excessively large sample counts until the package is updated. Additionally, consider using file validation to check for potential vulnerabilities before processing.
Conclusion
CVE-2026-27622 is a significant vulnerability in the OpenEXR library that can lead to severe consequences if not addressed. Users are strongly advised to update to the latest patched versions to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for openexr →
FAQ
CVE-2026-27622 is a vulnerability in the OpenEXR library that allows for heap out-of-bounds writes due to an integer overflow in the sample count accumulation.
An attacker can exploit this vulnerability by providing a specially crafted multipart deep EXR file with large sample counts, leading to memory corruption and potential remote code execution.
The vulnerability affects OpenEXR versions from 2.3.0 up to but not including 3.2.6, 3.3.8, and 3.4.6, which contain the necessary patches.
The impacts include denial of service, memory corruption, and the potential for remote code execution, making it critical to address.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
