CVE-2026-40250 PUBLISHED

OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)

Assigner: GitHub_M
Reserved: 10.04.2026 Published: 21.04.2026 Updated: 21.04.2026

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.4

Product Status

Vendor AcademySoftwareFoundation
Product openexr
Versions
  • Version >= 3.2.0, < 3.2.8 is affected
  • Version >= 3.3.0, < 3.3.10 is affected
  • Version >= 3.4.0, < 3.4.10 is affected

References

Problem Types

  • CWE-190: Integer Overflow or Wraparound CWE