← Back to CVEs
CVE-2026-40244
HIGH7.1
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, `internal_dwa_compressor.h:1722` performs `curc->width * curc->height` in `int32` arithmetic without a `(size_t)` cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses `internal_dwa_compressor.h:1722`.
CVE Details
CVSS v3.1 Score7.1
SeverityHIGH
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Attack VectorLOCAL
ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
Published4/21/2026
Last Modified4/22/2026
Sourcenvd
Honeypot Sightings0
Affected Products
openexr:openexr
Weaknesses (CWE)
CWE-190
References
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.8(security-advisories@github.com)
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.10(security-advisories@github.com)
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.10(security-advisories@github.com)
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-j526-66f6-fxhx(security-advisories@github.com)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.