DEBIAN-CVE-2026-34589

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-34589
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34589.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-34589
Upstream
  • CVE-2026-34589
Published
2026-04-06T16:16:36.040Z
Modified
2026-04-08T09:00:57.898951Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, the DWA lossy decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. For a large enough width, the calculation overflows and later decoder stores operate on a wrapped pointer outside the allocated rowBlock backing store. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.

References

Affected packages

Debian:11 / openexr

Package

Name
openexr
Purl
pkg:deb/debian/openexr?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.5.4-2
2.5.4-2+deb11u1
2.5.7-1
3.*
3.1.3-1
3.1.3-2
3.1.4-1
3.1.5-1
3.1.5-2
3.1.5-3
3.1.5-4
3.1.5-5
3.1.5-5.1
3.1.5-5.1+hurd.1
3.1.13-1
3.1.13-2
3.4.6+ds-1
3.4.6+ds-2
3.4.6+ds-3
3.4.6+ds-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34589.json"

Debian:12 / openexr

Package

Name
openexr
Purl
pkg:deb/debian/openexr?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.5-5
3.1.5-5.1
3.1.5-5.1+hurd.1
3.1.13-1
3.1.13-2
3.4.6+ds-1
3.4.6+ds-2
3.4.6+ds-3
3.4.6+ds-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34589.json"

Debian:13 / openexr

Package

Name
openexr
Purl
pkg:deb/debian/openexr?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.13-2
3.4.6+ds-1
3.4.6+ds-2
3.4.6+ds-3
3.4.6+ds-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34589.json"

Debian:14 / openexr

Package

Name
openexr
Purl
pkg:deb/debian/openexr?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.13-2
3.4.6+ds-1
3.4.6+ds-2
3.4.6+ds-3
3.4.6+ds-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34589.json"