QwikSec

Security Database

CVE

CWE

Training

CVE-2026-34543

Published: Apr 1, 2026

Modified: Apr 2, 2026

PUBLISHED

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, sensitive information from heap memory may be leaked through the decoded pixel data (information disclosure). This occurs under default settings; simply reading a malicious EXR file is sufficient to trigger the issue, without any user interaction. This issue has been patched in version 3.4.8.

Vendor	Product	Versions
AcademySoftwareFoundation	openexr	affected `>= 3.4.0, < 3.4.8`

Weaknesses (CWE)

References

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-vc68-257w-m432

x_refsource_CONFIRM

https://github.com/AcademySoftwareFoundation/openexr/commit/5f6d0aaa9e43802917af7db90f181e88e083d3b8

x_refsource_MISC

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.