CVE-2026-27622 in OpenEXR
Summary
by MITRE • 03/04/2026
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/01/2026
The vulnerability identified as CVE-2026-27622 affects OpenEXR, a widely-used image storage format in the motion picture industry that provides specifications and reference implementations for the EXR file format. This issue resides within the CompositeDeepScanLine::readPixels function where the software processes per-pixel data during image decompression operations. The flaw manifests when processing attacker-controlled large counts across multiple parts of an image, creating a scenario where vector<unsigned int> total_sizes accumulates these values in a manner susceptible to integer overflow. The specific vulnerability occurs at total_sizes[ptr] which wraps modulo 2^32, effectively allowing attackers to manipulate the accumulation process through carefully crafted input data.
The operational impact of this vulnerability extends beyond simple integer overflow to create a serious memory corruption condition that can lead to arbitrary code execution. When overall_sample_count is derived from these wrapped totals, it becomes significantly smaller than the actual required buffer size for proper decompression operations. This discrepancy causes samples[channel].resize(overall_sample_count) to allocate insufficient memory for the decompression process, setting up a scenario where subsequent decode pointer setup and consumption operations proceed using false sample counts. The core issue emerges in the generic_unpack_deep_pointers function where write operations overrun the undersized composite sample buffer, creating potential for memory corruption and exploitation.
This vulnerability maps directly to CWE-190, Integer Overflow or Wraparound, and CWE-787, Out-of-bounds Write, which are fundamental security concerns in software development and memory management. The attack pattern aligns with ATT&CK techniques including T1059.007, Command and Scripting Interpreter: Python, and T1203, Exploitation for Client Execution, as attackers could craft malicious EXR files to trigger the buffer overflow conditions. The affected versions span OpenEXR v3.2.x, v3.3.x, and v3.4.x, indicating this is a persistent issue across multiple release lines that required patching in the latest stable versions. The fix implemented in v3.2.6, v3.3.8, and v3.4.6 addresses the root cause by properly handling integer overflow conditions and ensuring adequate buffer allocation based on actual sample counts rather than potentially wrapped values. Organizations using OpenEXR should immediately upgrade to these patched versions to mitigate the risk of remote code execution through crafted EXR file inputs.