CVE-2026-40244
OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.
- Record
CVE-2026-40244- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-190, CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-24046
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.
- Record
EUVD-2026-24046- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.
- Record
CVE-2026-40244- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-40244
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.
- Record
ALPINE-CVE-2026-40244- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2026-40244
- Record
BELL-CVE-2026-40244- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSV
OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.
- Record
CVE-2026-40244- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2026-40244
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.
- Record
DEBIAN-CVE-2026-40244- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-807
Integer overflow in OpenEXR's `internal_dwa_compressor`
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.
- Record
JLSEC-2026-807- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2179
OpenEXR security update
OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.
Security Fix(es):
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.(CVE-2026-40244)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.(CVE-2026-40250)
- Record
OESA-2026-2179- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2180
OpenEXR security update
OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.
Security Fix(es):
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.(CVE-2026-40244)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.(CVE-2026-40250)
- Record
OESA-2026-2180- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2181
OpenEXR security update
OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.
Security Fix(es):
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.(CVE-2026-40244)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.(CVE-2026-40250)
- Record
OESA-2026-2181- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-40244
CVE-2026-40244 in openexr - Patched by Root
Root has patched CVE-2026-40244 in the openexr package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2026-40244- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-40244
CVE-2026-40244 in openexr - Patched by Root
Root has patched CVE-2026-40244 in the openexr package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-40244- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-40244
CVE-2026-40244 in openexr - Patched by Root
Root has patched CVE-2026-40244 in the openexr package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-40244- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-40244
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.
- Record
UBUNTU-CVE-2026-40244- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10665-1 No score
libIex-3_4-33-3.4.9-4.1 on GA media
These are all security issues fixed in the libIex-3_4-33-3.4.9-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10665-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20652-1 No score
Security update for openexr
This update for openexr fixes the following issues:
- CVE-2026-40244: integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (bsc#1262426).
- CVE-2026-40250: integer overflow in DWA decoder outBufferEnd pointer arithmetic (bsc#1262425).
- Record
openSUSE-SU-2026:20652-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1712-1 No score
Security update for openexr
This update for openexr fixes the following issues:
- CVE-2026-40244: Integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (bsc#1262426).
- CVE-2026-40250: Integer overflow in DWA decoder outBufferEnd pointer arithmetic (bsc#1262425).
- Record
SUSE-SU-2026:1712-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21433-1 No score
Security update for openexr
This update for openexr fixes the following issues:
- CVE-2026-40244: integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (bsc#1262426).
- CVE-2026-40250: integer overflow in DWA decoder outBufferEnd pointer arithmetic (bsc#1262425).
- Record
SUSE-SU-2026:21433-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openexrAlpine:v3.22 |
3.2.0 up to 3.3.11-r0 | 3.3.11-r0 |
openexrAlpine:v3.23 |
3.2.0 up to 3.4.13-r0 | 3.4.13-r0 |
openexrAlpine:v3.24 |
3.2.0 up to 3.4.10-r0 | 3.4.10-r0 |
openexrAlpaquita:stream |
3.4.4-r0 up to 3.4.10-r0 | 3.4.10-r0 |
openexrDebian:12 |
All versions, plus listed versions 3.1.13-13.1.13-23.1.5-53.1.5-5.13.1.5-5.1+hurd.1 Show 8 moreShow less3.4.14-0.13.4.15+ds-13.4.16+ds-13.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-43.5.2+ds-1 |
None known |
openexrDebian:13 |
All versions, plus listed versions 3.1.13-23.4.14-0.13.4.15+ds-13.4.16+ds-13.4.6+ds-1 Show 4 moreShow less3.4.6+ds-23.4.6+ds-33.4.6+ds-43.5.2+ds-1 |
None known |
openexrDebian:14 |
before 3.4.14-0.1, plus listed versions 3.1.13-23.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-4 |
3.4.14-0.1 |
OpenEXR_jllJulia |
3.1.4+0 up to 3.4.12+0 | 3.4.12+0 |
OpenEXRopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 3.1.11-8.oe2403sp1 | 3.1.11-8.oe2403sp1 |
OpenEXRopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 3.1.11-8.oe2403sp3 | 3.1.11-8.oe2403sp3 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
OpenEXRopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 3.1.11-8.oe2403 | 3.1.11-8.oe2403 |
openexrRoot:Debian:11 |
before 2.5.4-2+deb11u1.root.io.13 | 2.5.4-2+deb11u1.root.io.132.5.4-2+deb11u1.root.io.142.5.4-2+deb11u1.aikido.172.5.4-2+deb11u1.aikido.162.5.4-2+deb11u1.root.io.152.5.4-2+deb11u1.aikido.18 |
rootio-openexrRoot:Debian:11 |
before 2.5.4-2+deb11u1.root.io.13 | 2.5.4-2+deb11u1.root.io.132.5.4-2+deb11u1.root.io.142.5.4-2+deb11u1.aikido.172.5.4-2+deb11u1.aikido.162.5.4-2+deb11u1.root.io.152.5.4-2+deb11u1.aikido.18 |
openexrRoot:Debian:12 |
before 3.1.5-5.root.io.21 | 3.1.5-5.root.io.213.1.5-5.root.io.223.1.5-5.root.io.233.1.5-5.root.io.173.1.5-5.root.io.183.1.5-5.root.io.193.1.5-5.root.io.203.1.5-5.aikido.243.1.5-5.aikido.25 |
rootio-openexrRoot:Debian:12 |
before 3.1.5-5.root.io.21 | 3.1.5-5.root.io.213.1.5-5.root.io.223.1.5-5.root.io.233.1.5-5.root.io.173.1.5-5.root.io.183.1.5-5.root.io.193.1.5-5.root.io.203.1.5-5.aikido.243.1.5-5.aikido.25 |
openexrRoot:Debian:13 |
before 3.1.13-2.aikido.14 | 3.1.13-2.aikido.143.1.13-2.root.io.113.1.13-2.root.io.133.1.13-2.root.io.123.1.13-2.aikido.15 |
rootio-openexrRoot:Debian:13 |
before 3.1.13-2.aikido.14 | 3.1.13-2.aikido.143.1.13-2.root.io.113.1.13-2.root.io.133.1.13-2.root.io.123.1.13-2.aikido.15 |
openexrUbuntu:26.10 |
All versions, plus listed versions 3.1.13-2build13.4.6+ds-4ubuntu3 |
None known |
openexropenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 3.4.9-4.1 | 3.4.9-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40244 is a high vulnerability (CVSS 8.4) in Academysoftwarefoundation Openexr, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in openexr 3.3.11-r0.
References
github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-j526-66f6-fxhx
access.redhat.com/security/cve/CVE-2026-40244
bugzilla.redhat.com/show_bug.cgi?id=2459955
Show 19 moreShow less
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40244.json
security.alpinelinux.org/vuln/CVE-2026-40244
docs.bell-sw.com/security/cves/CVE-2026-40244
nvd.nist.gov/vuln/detail/CVE-2026-40244
security-tracker.debian.org/tracker/CVE-2026-40244
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2179
suse.com/support/update/announcement/2026/suse-su-20261712-1
bugzilla.suse.com/1262425
ubuntu.com/security/CVE-2026-40244
cve.org/CVERecord?id=CVE-2026-40244