Bug 2455408 (CVE-2026-34588) - CVE-2026-34588 OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file
Summary: CVE-2026-34588 OpenEXR: OpenEXR: Arbitrary code execution and information dis...
Keywords:
Status: NEW
Alias: CVE-2026-34588
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2455503 2455504 2455502 2455505
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-06 16:03 UTC by OSIDB Bzimport
Modified: 2026-05-20 11:12 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:15887 0 None None None 2026-05-11 01:42:50 UTC
Red Hat Product Errata RHSA-2026:15888 0 None None None 2026-05-11 21:32:31 UTC
Red Hat Product Errata RHSA-2026:17656 0 None None None 2026-05-14 16:30:31 UTC
Red Hat Product Errata RHSA-2026:17658 0 None None None 2026-05-14 17:41:35 UTC
Red Hat Product Errata RHSA-2026:17659 0 None None None 2026-05-14 17:18:25 UTC
Red Hat Product Errata RHSA-2026:17660 0 None None None 2026-05-14 17:43:07 UTC
Red Hat Product Errata RHSA-2026:19146 0 None None None 2026-05-19 16:09:40 UTC
Red Hat Product Errata RHSA-2026:19359 0 None None None 2026-05-19 21:40:24 UTC
Red Hat Product Errata RHSA-2026:19587 0 None None None 2026-05-20 11:12:31 UTC

Description OSIDB Bzimport 2026-04-06 16:03:01 UTC 
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
Comment 2 errata-xmlrpc 2026-05-11 01:42:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:15887 https://access.redhat.com/errata/RHSA-2026:15887
Comment 3 errata-xmlrpc 2026-05-11 21:32:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:15888 https://access.redhat.com/errata/RHSA-2026:15888
Comment 4 errata-xmlrpc 2026-05-14 16:30:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:17656 https://access.redhat.com/errata/RHSA-2026:17656
Comment 5 errata-xmlrpc 2026-05-14 17:18:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:17659 https://access.redhat.com/errata/RHSA-2026:17659
Comment 6 errata-xmlrpc 2026-05-14 17:41:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:17658 https://access.redhat.com/errata/RHSA-2026:17658
Comment 7 errata-xmlrpc 2026-05-14 17:43:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:17660 https://access.redhat.com/errata/RHSA-2026:17660
Comment 8 errata-xmlrpc 2026-05-19 16:09:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19146 https://access.redhat.com/errata/RHSA-2026:19146
Comment 9 errata-xmlrpc 2026-05-19 21:40:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19359 https://access.redhat.com/errata/RHSA-2026:19359
Comment 10 errata-xmlrpc 2026-05-20 11:12:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:19587 https://access.redhat.com/errata/RHSA-2026:19587
Note You need to log in before you can comment on or make changes to this bug.