OpenEXR hat eine fehlerhafte Schreiboperation in LossyDctDecoder_execute, was zu undefiniertem Verhalten führt (DWA/DWAB-Dekomprimierung)

An attacker could exploit this vulnerability by crafting a malicious EXR file containing a DWA or DWAB-compressed FLOAT channel. When OpenEXR attempts to decode this file, the unaligned memory write can lead to a crash, denial of service, or potentially arbitrary code execution, depending on the system's memory protection mechanisms. The impact is particularly concerning in environments where EXR files are processed automatically, such as image processing pipelines or rendering farms. Successful exploitation could allow an attacker to compromise the system processing the malicious file, potentially gaining control or exfiltrating sensitive data.

Motion picture production studios and post-production houses that rely on OpenEXR for image processing are particularly at risk. Systems involved in automated image processing pipelines, especially those handling user-uploaded EXR files, are also vulnerable. Any environment utilizing older, unpatched versions of OpenEXR is potentially exposed.

• linux / server:

journalctl -g "OpenEXR" -f | grep -i "memory access violation"

• c: (Requires debugging tools and memory analysis) Examine core dumps or crash reports related to OpenEXR for memory access violations within the LossyDctDecoder_execute() function. Use debuggers like GDB to step through the code and identify the misaligned memory write. • generic web: Monitor web server access logs for requests containing EXR files with unusual compression or channel types. Look for patterns that might indicate malicious file uploads or processing.

1. 2026-04-06Disclosure

   disclosure

1. Reserviert2026-03-27
2. Veröffentlicht2026-04-06
3. Geändert2026-04-07
4. EPSS aktualisiert2026-04-14

The primary mitigation for CVE-2026-34379 is to upgrade to OpenEXR version 3.2.7 or later. If upgrading is not immediately feasible, consider implementing input validation to reject EXR files with DWA or DWAB compression containing FLOAT channels. WAFs or proxies can be configured to block requests containing such files. While a specific Sigma or YARA rule is not readily available, monitoring memory access patterns during EXR decoding could potentially identify anomalous behavior. After upgrading, confirm the fix by attempting to decode a known malicious EXR file (if available) or by performing regression testing of image processing workflows.