Bug 2455408 (CVE-2026-34588)

Summary:	CVE-2026-34588 OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker could exploit an integer overflow vulnerability in the `internal_exr_undo_piz()` function by providing a specially crafted EXR file. This flaw leads to out-of-bounds reads and writes, which may allow for arbitrary code execution or sensitive information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2455503, 2455502, 2455504, 2455505
Bug Blocks:

Description OSIDB Bzimport 2026-04-06 16:03:01 UTC

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.

Comment 2 errata-xmlrpc 2026-05-11 01:42:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:15887 https://access.redhat.com/errata/RHSA-2026:15887

Comment 3 errata-xmlrpc 2026-05-11 21:32:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:15888 https://access.redhat.com/errata/RHSA-2026:15888

Comment 4 errata-xmlrpc 2026-05-14 16:30:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:17656 https://access.redhat.com/errata/RHSA-2026:17656

Comment 5 errata-xmlrpc 2026-05-14 17:18:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:17659 https://access.redhat.com/errata/RHSA-2026:17659

Comment 6 errata-xmlrpc 2026-05-14 17:41:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:17658 https://access.redhat.com/errata/RHSA-2026:17658

Comment 7 errata-xmlrpc 2026-05-14 17:43:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:17660 https://access.redhat.com/errata/RHSA-2026:17660

Comment 8 errata-xmlrpc 2026-05-19 16:09:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19146 https://access.redhat.com/errata/RHSA-2026:19146

Comment 9 errata-xmlrpc 2026-05-19 21:40:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19359 https://access.redhat.com/errata/RHSA-2026:19359

Comment 10 errata-xmlrpc 2026-05-20 11:12:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:19587 https://access.redhat.com/errata/RHSA-2026:19587