CVE-2026-34589: 
Python vulnerability analysis and mitigation

CVE-2026-34589 is a heap out-of-bounds write vulnerability in the DWA lossy decoder of OpenEXR, an image storage library widely used in the motion picture industry. It affects OpenEXR versions 3.2.0–3.2.6, 3.3.0–3.3.8, and 3.4.0–3.4.8. The vulnerability was discovered by Quang Luong of Calif.io, published on April 5–6, 2026, and fixed in versions 3.2.7, 3.3.9, and 3.4.9 (Github Advisory, Red Hat Bugzilla). It carries a CVSS v3.1 base score of 5.0 (Medium) and a CVSS v4.0 base score of 8.4 (High) (Github Advisory).

The root cause is an integer overflow (CWE-190) leading to an out-of-bounds write (CWE-787) in src/lib/OpenEXRCore/internal_dwa_decoder.h. The vulnerable code constructs per-component block pointers using signed 32-bit arithmetic: rowBlock[comp] = rowBlock[comp - 1] + numBlocksX * 64;. When numBlocksX is sufficiently large (e.g., 33,554,432), the multiplication numBlocksX * 64 overflows a signed 32-bit integer, causing rowBlock[comp] to wrap and point backward into memory outside the allocated rowBlockHandle buffer. The LossyDctDecoder_execute() function subsequently performs real memory stores through these corrupted pointers during block shuffle and DCT reconstruction, triggering a heap out-of-bounds write. The vulnerability is reachable via the standard public decoder path: InputFile::readPixels → exr_decoding_run → exr_uncompress_chunk → internal_exr_undo_dwaa → DwaCompressor_uncompress → LossyDctDecoder_execute (Github Advisory).

Successful exploitation can result in application crashes (denial of service) or memory corruption that may enable arbitrary code execution, depending on heap layout and exploitation sophistication. The vulnerability is triggered locally when a user or application opens a specially crafted DWAA/DWA scanline EXR file, affecting any software that uses the vulnerable OpenEXR library for image processing — including VFX, rendering, and media production tools. While the CVSS v3.1 score reflects only an availability impact, the CVSS v4.0 rating acknowledges potential high confidentiality and integrity impacts due to the nature of the heap write primitive (Github Advisory, Red Hat Bugzilla).

1. Craft a malicious EXR file: Create or obtain a crafted DWAA/DWA scanline EXR file with an image width large enough that numBlocksX * 64 overflows a signed 32-bit integer (e.g., numBlocksX ≥ 33,554,432). The PoC file dwa_scanline_exrcheck.zip from the advisory can be used directly.
2. Deliver the file to the target: Social-engineer a user or automated pipeline into opening the malicious .exr file using any application that links against a vulnerable version of OpenEXR (3.2.0–3.2.6, 3.3.0–3.3.8, or 3.4.0–3.4.8).
3. Trigger decoding: When the application reads the file, the standard decoder path (InputFile::readPixels → exr_decoding_run → exr_uncompress_chunk → internal_exr_undo_dwaa → DwaCompressor_uncompress → LossyDctDecoder_execute) is invoked.
4. Integer overflow triggers: In internal_dwa_decoder.h, the expression numBlocksX * 64 overflows signed 32-bit arithmetic, causing rowBlock[comp] to wrap to an out-of-bounds memory address.
5. Out-of-bounds write occurs: LossyDctDecoder_execute() performs memory stores through the corrupted pointer, writing outside the rowBlockHandle allocation — resulting in a crash (SEGV) or potential memory corruption exploitable for code execution (Github Advisory).

• Process: Application crash (SIGSEGV) in a process loading OpenEXR files, with stack traces referencing LossyDctDecoder_execute in internal_dwa_decoder.h:524 or DwaCompressor_uncompress in internal_dwa_compressor.h.
• Logs: UBSan/ASAN output containing signed integer overflow: 33554432 * 64 cannot be represented in type 'int' or AddressSanitizer: SEGV on unknown address with write access in the OpenEXR decode path.
• File System: Presence of unexpected or externally sourced .exr files with unusually large image width values in directories processed by media/rendering pipelines.
• Network: Unexpected inbound transfer of .exr files from untrusted sources to systems running OpenEXR-dependent applications (Github Advisory).

Upgrade OpenEXR to the patched versions: 3.2.7, 3.3.9, or 3.4.9, depending on the currently deployed branch (OpenEXR v3.2.7 Release, OpenEXR v3.3.9 Release). As a workaround where patching is not immediately possible, restrict processing of EXR files from untrusted or external sources, and implement input validation to reject files with image widths that would cause numBlocksX * 64 to overflow a 32-bit integer. Linux distribution packages (Fedora, openSUSE, FreeBSD) have also begun shipping updated packages addressing this CVE.

Red Hat tracked the issue as high severity in their Bugzilla system, describing it as "Memory corruption leading to arbitrary code execution or denial of service" (Red Hat Bugzilla). The openSUSE and Fedora security teams issued advisories and updated their packages shortly after disclosure. The vulnerability was detected by multiple commercial scanners including Nessus and Qualys, indicating broad industry awareness and rapid integration into vulnerability management tooling.