Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
According to https://www.cve.org/CVERecord?id=CVE-2026-34545, the vulnerability existed, and was fixed by https://github.com/AcademySoftwareFoundation/openexr/commit/3827998f5c041d6a94c6af24bbb363daa669e4b3, in the ht_undo_impl function. No function of that name is present in the OpenEXR subset that is bundled in OpenUSD, and searching for snippets of context surrounding the changes in the fix doesn’t turn up any evidence that related code, even after refactoring, might be present in OpenUSD. Therefore, I conclude that the usd package appears to be unaffected.