Loading story…
OpenEXR patched two high-severity memory corruption vulnerabilities that can be triggered by decoding crafted .exr image files. CVE-2026-34545 affects OpenEXR 3.4.0 through before 3.4.7 and stems from an integer overflow in the HTJ2K decoder when processing an image with a channel width of 32768, leading to a heap-based buffer overflow with controlled out-of-bounds writes. The flaw could enable remote code execution in applications that open malicious EXR images, particularly where untrusted files are automatically parsed.
A second flaw, CVE-2026-34544, affects OpenEXR 3.4.0 through before 3.4.8 and allows an out-of-bounds write in uncompress_b44_impl() during exr_decoding_run() when handling crafted B44 or B44A-compressed EXR files. Depending on heap layout, the issue can cause immediate crashes or corrupt adjacent allocations, with the CVE classified under CWE-787 and CWE-190. Organizations using OpenEXR in media pipelines, rendering tools, or image-processing applications should upgrade to OpenEXR 3.4.8 to address both issues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
OpenEXR version 3.4.8 fixed CVE-2026-34543, an information disclosure flaw in PXR24 decompression caused by an unchecked decompressed size in undo_pxr24_impl(). A crafted EXR file could leak sensitive heap memory contents through decoded pixel data when processed.
OpenEXR released version 3.4.8 to address an integer overflow that can cause an out-of-bounds write in uncompress_b44_impl() during exr_decoding_run(). Successful exploitation could cause crashes or corrupt adjacent heap allocations when decoding malicious B44 or B44A EXR images.
The CVE record for CVE-2026-34544, an integer overflow leading to out-of-bounds write in OpenEXR's uncompress_b44_impl(), was received by security-advisories@github.com. The flaw affects OpenEXR versions 3.4.0 through before 3.4.8 and can be triggered by crafted B44 or B44A EXR files.
OpenEXR released version 3.4.7 to fix an integer-overflow-driven heap-based buffer overflow in the HTJ2K decoder affecting versions 3.4.0 through before 3.4.7. A crafted EXR file using HTJ2K compression and a channel width of 32768 could trigger out-of-bounds writes and potentially remote code execution during decoding.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two vulnerabilities were disclosed in **OpenEXRCore** affecting image compression and decompression paths for EXR files. `CVE-2026-34543` impacts **PXR24 decompression**: `exr_uncompress_buffer` in `compression.c` can treat libdeflate's short output condition as a successful decode, while `undo_pxr24_impl` in `internal_pxr24.c` trusts the `uncompressed_size` value from an untrusted EXR header instead of the actual decompressed byte count. A crafted truncated file can cause reconstruction logic to read beyond initialized `scratch_data` and include uninitialized heap contents in image output, creating an **information disclosure** risk. A second flaw, `CVE-2026-34544`, affects **B44/B44A compression and decompression** in `internal_b44.c`. The `uncompress_b44_impl` and `compress_b44_impl` functions use 32-bit signed integers for row-pointer offset calculations, and multiplying large image dimensions can overflow `INT_MAX`. The resulting negative offsets can point outside the allocated scratch buffer and trigger **out-of-bounds writes**, creating a heap memory corruption condition that could let attackers influence adjacent allocations depending on process layout.
Jun 29, 2026
LibRaw 0.22.1 was released with security fixes for multiple high-severity memory corruption and integer overflow vulnerabilities in the library’s RAW image parsing code, including **CVE-2026-21413** in `lossless_jpeg_load_raw`, **CVE-2026-20889** in `x3f_thumb_loader`, and **CVE-2026-20884** in `deflate_dng_load_raw`. The flaws were reported by Cisco Talos and affect parsing paths for formats such as Canon `CR2`, Sigma `X3F`, and DNG files, where crafted metadata or compressed image data can trigger heap-based buffer overflows or undersized allocations followed by out-of-bounds writes.
Jun 29, 2026
A high-severity heap buffer overflow in **ImageMagick**’s XBM image decoder (`coders/xbm.c`, `ReadXBMImage`) can be triggered by processing a specially crafted **XBM** file, including through common image upload/processing workflows. The flaw stems from **integer truncation** where `image->rows` (a 64-bit `size_t`) is cast to a 32-bit `unsigned int` for allocation, but subsequent write operations iterate using the original (non-truncated) `image->rows` value, creating a mismatch that can lead to memory corruption or crashes when attacker-supplied dimensions are large. Reporting indicates the overflow is particularly dangerous because attackers can influence both the **overflow size** (via image dimensions such as rows/columns) and the **data written** (via hex values embedded in the XBM content), enabling attacker-controlled bytes to be written past the heap buffer. The issue affects ImageMagick versions **prior to 7.1.2-13 and 6.9.13-38** and is fixed in **7.1.2-13** and **6.9.13-38**; the CVE record lists a high-impact CVSS vector `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` and maps the weakness to **CWE-190** and **CWE-122**, with upstream references including the vendor advisory and patch commit.
Jun 29, 2026