CVE-2026-34545

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34545
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34545.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34545
Aliases
  • GHSA-ghfj-fx47-wg97
Downstream
Related
Published
2026-04-01T20:51:45.884Z
Modified
2026-07-16T03:48:28.697150414Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenEXR: integer overflow lead to OOB in HTJ2K decoder
Details

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.7, an attacker providing a crafted .exr file with HTJ2K compression and a channel width of 32768 can write controlled data beyond the output heap buffer in any application that decodes EXR images. The write primitive is 2 bytes per overflow iteration or 4 bytes (by another path), repeating for each additional pixel past the overflow point. In this context, a heap write overflow can lead to remote code execution on systems. This issue has been patched in version 3.4.7.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34545.json",
    "cwe_ids": [
        "CWE-122",
        "CWE-190"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/academysoftwarefoundation/openexr

Affected ranges

Type
GIT
Repo
https://github.com/academysoftwarefoundation/openexr
Events
Introduced
20a65852895894434bea88613f6d29ac8e88bd6e
Fixed
6768d5da78af4ba5b91bf3820ed11258f72743b0
Fixed
3827998f5c041d6a94c6af24bbb363daa669e4b3
Database specific 
{
    "cpe": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.7"
        }
    ]
}

Affected versions

v3.*
v3.4.0
v3.4.1
v3.4.1-rc
v3.4.1-rc2
v3.4.2
v3.4.2-rc
v3.4.2-rc2
v3.4.3
v3.4.3-rc
v3.4.3-rc2
v3.4.3-rc3
v3.4.4
v3.4.4-rc
v3.4.4-rc2
v3.4.5
v3.4.5-rc
v3.4.6
v3.4.6-rc
v3.4.7-rc

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34545.json"