CVE-2026-34588: 
Python vulnerability analysis and mitigation

CVE-2026-34588 is a signed 32-bit integer overflow vulnerability in OpenEXR's PIZ decoder (internal_exr_undo_piz()) that leads to out-of-bounds read and write conditions. It affects OpenEXR versions 3.1.0–3.1.13, 3.2.0–3.2.6, 3.3.0–3.3.8, and 3.4.0–3.4.8. The vulnerability was discovered by Quang Luong of Calif.io, published on April 5–6, 2026, and fixed in versions 3.2.7, 3.3.9, and 3.4.9. It carries a CVSS v4.0 base score of 8.6 (High) and a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is an integer overflow (CWE-190) in internal_exr_undo_piz() within src/lib/OpenEXRCore/internal_piz.c. The function advances a wavelet buffer pointer using the expression wavbuf += nx * ny * wcount, where nx, ny, and wcount are signed 32-bit integers (int). A crafted EXR file can supply values such as width=67108862, height=32, and specific channel sampling parameters that cause the product nx * ny * wcount to overflow and wrap to a negative value (e.g., -128), redirecting the pointer to an incorrect heap address. The subsequent wavelet decode via wdec14_4() then performs both reads (*px, *p10, *p01, *p11) and writes to those same locations at the corrupted address, yielding CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). Exploitation requires only that the attacker can supply a crafted EXR file to an application using the vulnerable library (Github Advisory).

Successful exploitation can result in heap buffer overflow with both out-of-bounds reads and writes, enabling memory disclosure (confidentiality impact), memory corruption (integrity impact), and process crash (availability impact). Depending on heap layout and surrounding allocator metadata, the out-of-bounds write primitive could potentially be leveraged for arbitrary code execution, as noted in the advisory. Applications in the motion picture and visual effects industries that process untrusted EXR files — including rendering pipelines, image viewers, and media processing tools — are at risk (Github Advisory, Red Hat Bugzilla).

1. Craft a malicious EXR file: Create an EXR file with PIZ compression containing specific channel parameters that trigger the overflow — e.g., width=67108862, height=32, channel A as FLOAT with sampling 1×1, and channel B as HALF with sampling 33554431×16. This makes nx * ny * wcount = 134217724 * 32 = 4294967168, which wraps to -128 in signed 32-bit arithmetic.
2. Deliver the file to the target: Place the crafted EXR file in a location accessible to the target application — e.g., a shared directory, an upload endpoint, or a media asset pipeline that processes EXR files using a vulnerable OpenEXR version (3.1.0–3.1.13, 3.2.0–3.2.6, 3.3.0–3.3.8, or 3.4.0–3.4.8).
3. Trigger PIZ decompression: Cause the application to open and decode the crafted EXR file. This invokes internal_exr_undo_piz() → wav_2D_decode() → wdec14_4() along the PIZ decompression path.
4. Integer overflow occurs: The pointer arithmetic wavbuf += nx * ny * wcount overflows, redirecting wavbuf to an address before the allocated scratch buffer.
5. OOB read/write achieved: wdec14_4() reads from and writes to the incorrect heap address, causing a heap-buffer-overflow. Depending on heap layout, this may crash the process, disclose adjacent memory contents, or corrupt heap metadata for further exploitation (Github Advisory).

• Process: Application crash or abnormal termination when opening a specific EXR file; ASAN/sanitizer output referencing heap-buffer-overflow in wdec14_4 at internal_piz.c:148.
• Logs: Application error logs showing segmentation faults or memory access violations during EXR PIZ decompression; Valgrind output reporting Invalid read of size 2 at internal_piz.c:150 or Invalid write of size 2 at internal_piz.c:171.
• File System: Presence of unexpected or externally sourced EXR files with unusually large width values (e.g., near 67108862) or atypical channel sampling configurations in media processing directories.
• Network: Unexpected inbound transfer of EXR files to systems running OpenEXR-dependent applications, particularly from untrusted or external sources (Github Advisory).

Upgrade OpenEXR to the patched versions: 3.2.7, 3.3.9, or 3.4.9, depending on the currently deployed branch. These releases were published on April 3, 2026, and address this vulnerability along with several other CVEs (OpenEXR v3.2.7, OpenEXR v3.3.9). Red Hat has issued errata for RHEL 9 (RHSA-2026:15887), RHEL 10 (RHSA-2026:15888), and several EUS/SAP variants (Red Hat Bugzilla). Ubuntu (USN-8259-1), openSUSE, Fedora, Amazon Linux 2, and Amazon Linux 2023 have also released updated packages. As a workaround where patching is not immediately possible, restrict processing of EXR files from untrusted sources and consider sandboxing applications that parse EXR files.

Red Hat classified the vulnerability as High severity and tracked it via Bugzilla, issuing multiple errata across RHEL 9, RHEL 10, and extended update support variants (Red Hat Bugzilla). The Academy Software Foundation (ASWF) promptly published the advisory and coordinated patch releases across three active version branches. Multiple Linux distributions including Ubuntu, openSUSE, Fedora, and Amazon Linux responded with security updates within weeks of disclosure. No significant independent researcher commentary or social media discussion beyond standard vulnerability tracking has been observed.