CVE-2026-34379

Full vulnerability record from the local CVENow database.

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a misaligned memory write vulnerability exists in LossyDctDecoder_execute() in src/lib/OpenEXRCore/internal_dwa_decoder.h:749. When decoding a DWA or DWAB-compressed EXR file containing a FLOAT-type channel, the decoder performs an in-place HALF→FLOAT conversion by casting an unaligned uint8_t * row pointer to float * and writing through it. Because the row buffer may not be 4-byte aligned, this constitutes undefined behavior under the C standard and crashes immediately on architectures that enforce alignment (ARM, RISC-V, etc.). On x86 it is silently tolerated at runtime but remains exploitable via compiler optimizations that assume aligned access. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.

Severity

HIGH

CVSS score

7.1 (v3.1)

Vulnerability status

Modified

Source identifier

[email protected]

Published

2026-04-06 16:16:35.233000

Last modified

2026-10-26 22:10:00.163000

View original CVE JSON

{
  "id": "CVE-2026-34379",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-06T16:16:35.233",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a misaligned memory write vulnerability exists in LossyDctDecoder_execute() in src/lib/OpenEXRCore/internal_dwa_decoder.h:749. When decoding a DWA or DWAB-compressed EXR file containing a FLOAT-type channel, the decoder performs an in-place HALF→FLOAT conversion by casting an unaligned uint8_t * row pointer to float * and writing through it. Because the row buffer may not be 4-byte aligned, this constitutes undefined behavior under the C standard and crashes immediately on architectures that enforce alignment (ARM, RISC-V, etc.). On x86 it is silently tolerated at runtime but remains exploitable via compiler optimizations that assume aligned access. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9."
    },
    {
      "lang": "es",
      "value": "OpenEXR proporciona la especificación e implementación de referencia del formato de archivo EXR, un formato de almacenamiento de imágenes para la industria cinematográfica. Desde la versión 3.2.0 hasta antes de las versiones 3.2.7, 3.3.9 y 3.4.9, existe una vulnerabilidad de escritura de memoria desalineada en LossyDctDecoder_execute() en src/lib/OpenEXRCore/internal_dwa_decoder.h:749. Al decodificar un archivo EXR comprimido con DWA o DWAB que contiene un canal de tipo FLOAT, el decodificador realiza una conversión in situ de HALF?FLOAT al convertir un puntero de fila uint8_t * no alineado a float * y escribir a través de él. Debido a que el búfer de fila puede no estar alineado a 4 bytes, esto constituye un comportamiento indefinido según el estándar C y provoca fallos inmediatamente en arquitecturas que imponen la alineación (ARM, RISC-V, etc.). En x86, se tolera silenciosamente en tiempo de ejecución, pero sigue siendo explotable a través de optimizaciones del compilador que asumen acceso alineado. Esta vulnerabilidad se corrige en las versiones 3.2.7, 3.3.9 y 3.4.9."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "AcademySoftwareFoundation",
          "product": "openexr",
          "versions": [
            {
              "version": ">= 3.2.0, < 3.2.7",
              "status": "affected"
            },
            {
              "version": ">= 3.3.0, < 3.3.9",
              "status": "affected"
            },
            {
              "version": ">= 3.4.0, < 3.4.9",
              "status": "affected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "OpenEXR",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "defaultStatus": "unknown",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "OpenEXR",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "defaultStatus": "unknown",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "OpenEXR",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "OpenEXR",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "OpenEXR",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      },
      {
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-06T18:38:21.966448Z",
          "id": "CVE-2026-34379",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-704"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        },
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-475"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.2.0",
              "versionEndExcluding": "3.2.7",
              "matchCriteriaId": "4E7AA082-2647-4AAD-9902-1E3873882A3D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.3.0",
              "versionEndExcluding": "3.3.9",
              "matchCriteriaId": "E8321A2E-759A-4B1E-9AAF-0204791F4323"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.4.0",
              "versionEndExcluding": "3.4.9",
              "matchCriteriaId": "94F2D271-636B-4E9E-A04B-40E635A59117"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.7",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.9",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-w88v-vqhq-5p24",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-34379",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455402",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34379.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ]
}