CVE-2026-27622

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.

Risk Information

Base Score

7.8

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.013

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2026-27622 are fixed in Python-openexr 3.2.6	Windows
Vulnerabilities CVE-2026-27622 are fixed in Python-openexr 3.3.8	Windows
Vulnerabilities CVE-2026-27622 are fixed in Python-openexr 3.4.6	Windows
Vulnerabilities CVE-2026-27622 are fixed in Python-openexr for linux 3.2.6	Linux
Vulnerabilities CVE-2026-27622 are fixed in Python-openexr for linux 3.3.8	Linux
Vulnerabilities CVE-2026-27622 are fixed in Python-openexr for linux 3.4.6	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234