CVE-2026-34543: academysoftwarefoundation openexr Use of Uninitialized Resource
Vulnerability summary
CVE-2026-34543 is a high (CVSS 8.7) Use of Uninitialized Resource vulnerability in academysoftwarefoundation openexr. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 01-04-2026PublishedVulnerability first disclosed.
- 02-04-2026Last modifiedVulnerability information updated.
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, sensitive information from heap memory may be leaked through the decoded pixel data (information disclosure). This occurs under default settings; simply reading a malicious EXR file is sufficient to trigger the issue, without any user interaction. This issue has been patched in version 3.4.8.
CVSS metrics
9 scores · 7 sources · 2 versions- OSV · PypiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
+0.04 pp
From 0.48% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOpenexr
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- openexr< 3.4.9-r0
- openexr-dev< 3.4.9-r0
- openexr-doc< 3.4.9-r0
- openexr-libiex< 3.4.9-r0
- openexr-libilmthread< 3.4.9-r0
Wolfi8 products
- openexr< 3.4.9-r0
- openexr-dev< 3.4.9-r0
- openexr-doc< 3.4.9-r0
- openexr-libiex< 3.4.9-r0
- openexr-libilmthread< 3.4.9-r0
Academysoftwarefoundation1 product
- openexr≥ 3.4.0, < 3.4.8
Debian1 product
- openexrAll versions (No fix recorded) | < 3.4.14-0.1
Openexr1 product
- openexr≥ 3.2.0, < 3.2.7 | ≥ 3.3.0, < 3.3.9 | ≥ 3.4.0, < 3.4.8
PyPI1 product
- openexr≥ 3.4.0, < 3.4.8 | ≥ 3.3.0, ≤ 3.3.8 | ≥ 3.2.0, ≤ 3.2.6 | ≥ 3.2.0, < 3.4.8
Ubuntu1 product
- openexrAll versions (No fix recorded)
7 vendors · 21 products
References
11 links- github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-vc68-257w-m432X Refsource CONFIRMWEBREPORTAdvisoryExploitVendor Advisory
- github.com/AcademySoftwareFoundation/openexr/commit/5f6d0aaa9e43802917af7db90f181e88e083d3b8X Refsource MISCWEBREPORTFIXPatch
- github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8X Refsource MISCWEBREPORTProductRelease Notes
- pypi.org/project/openexrPACKAGE
