CVE-2026-40250
OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, `internal_dwa_compressor.h:1040` performs `chan->width * chan->bytes_per_element` in `int32` arithmetic without a `(size_t)` cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses `internal_dwa_compressor.h:1040`.
| CWE | CWE-190 |
| Vendor | academysoftwarefoundation |
| Product | openexr |
| Published | Apr 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for academysoftwarefoundation openexr
Be the first to know when new unknown vulnerabilities affecting academysoftwarefoundation openexr are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
AcademySoftwareFoundation / openexr
>= 3.2.0, < 3.2.8 >= 3.3.0, < 3.3.10 >= 3.4.0, < 3.4.10
References
github.com: https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m5qw-23x2-6phj github.com: https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.8 github.com: https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.10 github.com: https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.10