CVE-2026-40244: 
NixOS vulnerability analysis and mitigation

CVE-2026-40244 is an integer overflow vulnerability in OpenEXR's DWA compressor, specifically in internal_dwa_compressor.h at line 1722, where curc->width * curc->height is computed using int32 arithmetic without a (size_t) cast. This is a missed variant of the overflow pattern previously addressed in CVE-2026-34589. Affected versions include OpenEXR 3.2.0–3.2.7, 3.3.0–3.3.9, and 3.4.0–3.4.9. The vulnerability was published on April 21, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an integer overflow (CWE-190) in the setupChannelData function of OpenEXR's DWA decompressor. At line 1722 of internal_dwa_compressor.h, the expression cd->planarUncRle[byte] = cd->planarUncRle[byte - 1] + curc->width * curc->height performs the multiplication of two int32_t values without casting to size_t. When width * height exceeds INT32_MAX, the result wraps around, causing planarUncRle[byte] to point inside or before the allocated buffer rather than after it. This aliased pointer is subsequently used during RLE decoding, leading to heap memory corruption. The vulnerable code path is reachable via crafted DWAA/DWAB-compressed EXR files with large dimensions on non-DCT channels (e.g., UINT or single-channel layouts), triggered through exr_decoding_run() → internal_exr_undo_dwa() → DwaCompressor_uncompress() → setupChannelData. The fix requires adding (size_t) casts, consistent with the already-corrected line 1699 in the same function (GitHub Advisory).

Successful exploitation results in heap buffer corruption when a vulnerable application opens a crafted DWAA/DWAB EXR file with specially crafted large dimensions. This can lead to arbitrary code execution, denial of service, or memory disclosure, impacting confidentiality, integrity, and availability of the affected system. The attack is local and requires user interaction (opening a malicious file), limiting its scope, but applications that automatically process EXR files (e.g., media pipelines, VFX tools) may be at elevated risk (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Craft a malicious EXR file: Create a DWAA or DWAB-compressed EXR file with image dimensions where width * height > INT32_MAX (e.g., width = 65536, height = 65536, yielding ~4.3 billion pixels). Ensure the file uses non-DCT channels such as UINT or a single-channel layout to trigger the vulnerable setupChannelData code path.
2. Deliver the file to the target: Distribute the crafted EXR file via email attachment, file share, web upload, or any vector that causes the target application to open or process it. Applications in VFX, media production, or image processing pipelines that auto-ingest EXR files are particularly susceptible.
3. Trigger decoding: When the target application calls exr_decoding_run(), the DWA decompressor invokes internal_exr_undo_dwa() → DwaCompressor_uncompress() → setupChannelData, reaching line 1722 where the int32 overflow occurs.
4. Exploit heap corruption: The overflowed pointer causes planarUncRle[byte] to reference an incorrect heap location. Subsequent RLE decoding writes through this aliased pointer, corrupting heap memory in a potentially attacker-controlled manner.
5. Achieve code execution or DoS: Depending on heap layout and application specifics, the corruption may be leveraged for arbitrary code execution (e.g., via heap exploitation techniques) or may cause an immediate crash (denial of service) (GitHub Advisory).

• File System: Presence of unexpected or externally sourced .exr files with DWAA/DWAB compression and unusually large declared dimensions (width × height > ~2.1 billion pixels).
• Process: Application crashes or segmentation faults in processes that handle EXR files (e.g., image viewers, VFX tools, media servers), particularly with heap corruption error messages or core dumps.
• Logs: Crash reports or error logs from OpenEXR-linked applications referencing internal_dwa_compressor.h, setupChannelData, or DwaCompressor_uncompress; address sanitizer (ASAN) reports indicating heap-buffer-overflow during EXR decoding.
• Network: Unexpected inbound delivery of .exr files from untrusted or external sources to systems running vulnerable OpenEXR versions.

Upgrade OpenEXR to the patched versions: 3.2.8, 3.3.10, or 3.4.10, depending on the installed branch. These releases were published on April 17, 2026, and address both CVE-2026-40244 and the related CVE-2026-40250. As an interim measure, restrict processing of EXR files from untrusted sources and implement input validation to reject files with dimensions where width * height exceeds safe bounds before passing them to the OpenEXR library (GitHub v3.2.8, GitHub v3.3.10, GitHub v3.4.10).

The vulnerability was credited to researcher "Medoedus" and disclosed by the Academy Software Foundation (ASWF) via GitHub Security Advisories. Red Hat tracked it via Bugzilla and assigned it High severity. Coverage has been picked up by Linux distribution security trackers including FreeBSD VuXML, openSUSE, and SUSE, as well as vulnerability aggregators. No significant social media controversy or broad community debate has been observed beyond routine patch notification (GitHub Advisory, Red Hat Bugzilla).