CVE-2026-34378

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overflow in generic_unpack(). By setting dataWindow.min.x to a large negative value, OpenEXRCore computes an enormous image width, which is later used in a signed integer multiplication that overflows, causing the process to terminate with SIGILL via UBSan. This vulnerability is fixed in 3.4.9.

• CWE-190

• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9Product, Release Notes
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v76p-4qvv-vh4gExploit, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34372Sulu is an open-source PHP content management system based o…2.7
• CVE-2026-34373Parse Server is an open source backend that can be deployed …8.8
• CVE-2026-34374WWBN AVideo is an open source video platform. In versions up…9.1
• CVE-2026-34375WWBN AVideo is an open source video platform. In versions up…8.2
• CVE-2026-34376PdfDing is a selfhosted PDF manager, viewer and editor offer…7.5
• CVE-2026-34377ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…8.1
• CVE-2026-34379OpenEXR provides the specification and reference implementat…7.1
• CVE-2026-3438A reflected cross-site scripting vulnerability exists in Son…5.1
• CVE-2026-34380OpenEXR provides the specification and reference implementat…5.9
• CVE-2026-34381Admidio is an open-source user management solution. From ver…7.5
• CVE-2026-34382Admidio is an open-source user management solution. From ver…4.6
• CVE-2026-34383Admidio is an open-source user management solution. Prior to…3.5