Loading story…
Two vulnerabilities were disclosed in OpenEXRCore affecting image compression and decompression paths for EXR files. CVE-2026-34543 impacts PXR24 decompression: exr_uncompress_buffer in compression.c can treat libdeflate's short output condition as a successful decode, while undo_pxr24_impl in internal_pxr24.c trusts the uncompressed_size value from an untrusted EXR header instead of the actual decompressed byte count. A crafted truncated file can cause reconstruction logic to read beyond initialized scratch_data and include uninitialized heap contents in image output, creating an information disclosure risk.
A second flaw, CVE-2026-34544, affects B44/B44A compression and decompression in internal_b44.c. The uncompress_b44_impl and compress_b44_impl functions use 32-bit signed integers for row-pointer offset calculations, and multiplying large image dimensions can overflow INT_MAX. The resulting negative offsets can point outside the allocated scratch buffer and trigger out-of-bounds writes, creating a heap memory corruption condition that could let attackers influence adjacent allocations depending on process layout.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
OpenEXR disclosed CVE-2026-34589, a heap out-of-bounds write in the DWA lossy decoder caused by signed 32-bit arithmetic overflow when building per-component block pointers for large image widths. The issue affects versions 3.2.0 through before 3.2.7 and earlier supported 3.3 and 3.4 releases, and was fixed in versions 3.2.7, 3.3.9, and 3.4.9.
A second OpenEXRCore vulnerability was disclosed affecting B44 and B44A compression and decompression, where signed integer overflow in row-pointer offset calculations can trigger out-of-bounds writes in the scratch buffer.
A vulnerability in OpenEXR was disclosed in which truncated compressed data can be misinterpreted as successfully decompressed, causing the PXR24 decoder to read uninitialized heap memory and leak it through malformed image output.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenEXR patched two high-severity memory corruption vulnerabilities that can be triggered by decoding crafted `.exr` image files. **CVE-2026-34545** affects OpenEXR `3.4.0` through before `3.4.7` and stems from an integer overflow in the HTJ2K decoder when processing an image with a channel width of `32768`, leading to a heap-based buffer overflow with controlled out-of-bounds writes. The flaw could enable remote code execution in applications that open malicious EXR images, particularly where untrusted files are automatically parsed. A second flaw, **CVE-2026-34544**, affects OpenEXR `3.4.0` through before `3.4.8` and allows an out-of-bounds write in `uncompress_b44_impl()` during `exr_decoding_run()` when handling crafted B44 or B44A-compressed EXR files. Depending on heap layout, the issue can cause immediate crashes or corrupt adjacent allocations, with the CVE classified under `CWE-787` and `CWE-190`. Organizations using OpenEXR in media pipelines, rendering tools, or image-processing applications should upgrade to **OpenEXR 3.4.8** to address both issues.
Jun 29, 2026
LibRaw 0.22.1 was released with security fixes for multiple high-severity memory corruption and integer overflow vulnerabilities in the library’s RAW image parsing code, including **CVE-2026-21413** in `lossless_jpeg_load_raw`, **CVE-2026-20889** in `x3f_thumb_loader`, and **CVE-2026-20884** in `deflate_dng_load_raw`. The flaws were reported by Cisco Talos and affect parsing paths for formats such as Canon `CR2`, Sigma `X3F`, and DNG files, where crafted metadata or compressed image data can trigger heap-based buffer overflows or undersized allocations followed by out-of-bounds writes.
Jun 29, 2026
A high-severity heap buffer overflow in **ImageMagick**’s XBM image decoder (`coders/xbm.c`, `ReadXBMImage`) can be triggered by processing a specially crafted **XBM** file, including through common image upload/processing workflows. The flaw stems from **integer truncation** where `image->rows` (a 64-bit `size_t`) is cast to a 32-bit `unsigned int` for allocation, but subsequent write operations iterate using the original (non-truncated) `image->rows` value, creating a mismatch that can lead to memory corruption or crashes when attacker-supplied dimensions are large. Reporting indicates the overflow is particularly dangerous because attackers can influence both the **overflow size** (via image dimensions such as rows/columns) and the **data written** (via hex values embedded in the XBM content), enabling attacker-controlled bytes to be written past the heap buffer. The issue affects ImageMagick versions **prior to 7.1.2-13 and 6.9.13-38** and is fixed in **7.1.2-13** and **6.9.13-38**; the CVE record lists a high-impact CVSS vector `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` and maps the weakness to **CWE-190** and **CWE-122**, with upstream references including the vendor advisory and patch commit.
Jun 29, 2026