Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
DEBIAN-CVE-2026-39886
No affected components available
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Versions 3.4.0 through 3.4.9 have a signed integer overflow vulnerability in OpenEXR's HTJ2K (High-Throughput JPEG 2000) decompression path. The ht_undo_impl() function in src/lib/OpenEXRCore/internal_ht.cpp accumulates a bytes-per-line value (bpl) using a 32-bit signed integer with no overflow guard. A crafted EXR file with 16,385 FLOAT channels at the HTJ2K maximum width of 32,767 causes bpl to overflow INT_MAX, producing undefined behavior confirmed by UBSan. On an allocator-permissive host where the required ~64 GB allocation succeeds, the wrapped negative bpl value would subsequently be used as a per-scanline pointer advance, which would produce a heap out-of-bounds write. On a memory-constrained host, the allocation fails before ht_undo_impl() is entered. This is the second distinct integer overflow in ht_undo_impl(). CVE-2026-34545 addressed a different overflow in the same function — the int16_t p pixel-loop counter at line ~302 that overflows when iterating over channels whose width exceeds 32,767. The CVE-2026-34545 fix did not touch the int bpl accumulator at line 211, which is the subject of this advisory. The bpl accumulator was also not addressed by any of the 8 advisories in the 2026-04-05 v3.4.9 release batch. This finding is structurally identical to CVE-2026-34588 (PIZ wcount*nx overflow in internal_piz.c) and should be remediated with the same pattern. The CVE-2026-34588 fix did not touch internal_ht.cpp. Version 3.4.10 contains a remediation that addresses the vulnerability in internal_ht.cpp.
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a low impact on the availability of the system.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard