{
  "cveId": "CVE-2026-34588",
  "url": "https://patchblox.com/security/cve/CVE-2026-34588",
  "summary": "CVE-2026-34588 is fixed in 7 products on 1 platform, first by libopenexr-3-1-30 3.1.5-5.1ubuntu0.1~esm1, released April 6, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "openexr: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for t...",
  "description": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.",
  "published": "2026-04-06T09:16:00Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00501,
  "epssPercentile": 0.43187,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libopenexr-3-1-30",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3.1.5-5.1ubuntu0.1~esm1",
      "fix": "libopenexr-3-1-30 3.1.5-5.1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libopenexr-3-1-30-3.1.5-5.1ubuntu0.1-esm1",
      "released": "2026-04-06T09:16:00Z"
    },
    {
      "platform": "linux",
      "product": "libopenexr-3-1-30",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "3.1.13-2ubuntu0.26.04.1~esm1",
      "fix": "libopenexr-3-1-30 3.1.13-2ubuntu0.26.04.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libopenexr-3-1-30-3.1.13-2ubuntu0.26.04.1-esm1",
      "released": "2026-04-06T09:16:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "Debian 14",
      "fixedVersion": "3.4.14-0.1",
      "fix": "DEBIAN-CVE-2026-34588",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-34588",
      "released": "2026-04-06T16:16:35Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "RHEL 10",
      "fixedVersion": "3.1.10-8.el10_0.2",
      "fix": "RHSA-2026:17656",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-17656",
      "released": "2026-04-06T15:31:57Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "RHEL 9",
      "fixedVersion": "0:3.1.1-3.el9_8.2",
      "fix": "RHSA-2026:19359",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-19359",
      "released": "2026-05-15T16:04:04Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3.1.5-5.1ubuntu0.1~esm1",
      "fix": "openexr 3.1.5-5.1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-openexr-3.1.5-5.1ubuntu0.1-esm1",
      "released": "2026-04-06T09:16:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "3.1.13-2ubuntu0.26.04.1~esm1",
      "fix": "openexr 3.1.13-2ubuntu0.26.04.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-openexr-3.1.13-2ubuntu0.26.04.1-esm1",
      "released": "2026-04-06T09:16:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "almalinux 10",
      "fixedVersion": "3.1.10-8.el10_2.2",
      "fix": "ALSA-2026:19146",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19146",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "almalinux 9",
      "fixedVersion": "3.1.1-3.el9_8.2",
      "fix": "ALSA-2026:19359",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19359",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "amzn 2023",
      "fixedVersion": "3.1.5-1.amzn2023.0.9",
      "fix": "ALAS2023-2026-1612",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1612",
      "released": "2026-04-27T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "ol 10",
      "fixedVersion": "0:3.1.10-8.el10_1.2",
      "fix": "ELSA-2026-15888",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-15888",
      "released": "2026-05-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "ol 9",
      "fixedVersion": "0:3.1.1-3.el9_7.2",
      "fix": "ELSA-2026-15887",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-15887",
      "released": "2026-05-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.2.2-160000.6.1",
      "fix": "OPENSUSE-SU-2026:20605-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20605-1",
      "released": "2026-04-22T10:03:51Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "rocky 10",
      "fixedVersion": "0:3.1.10-8.el10_2.2",
      "fix": "RLSA-2026:19146",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-19146",
      "released": "2026-05-29T16:03:24Z"
    },
    {
      "platform": "linux",
      "product": "openexr",
      "release": "rocky 9",
      "fixedVersion": "0:3.1.1-3.el9_7.2",
      "fix": "RLSA-2026:19359",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-19359",
      "released": "2026-05-20T06:03:42Z"
    },
    {
      "platform": "linux",
      "product": "openexr-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "3.1.5-1.amzn2023.0.9",
      "fix": "ALAS2023-2026-1612",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1612",
      "released": "2026-04-27T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "3.1.5-1.amzn2023.0.9",
      "fix": "ALAS2023-2026-1612",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1612",
      "released": "2026-04-27T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-devel",
      "release": "RHEL 9",
      "fixedVersion": "0:3.1.1-3.el9_8.2",
      "fix": "RHSA-2026:19359",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-19359",
      "released": "2026-05-15T16:04:04Z"
    },
    {
      "platform": "linux",
      "product": "openexr-devel",
      "release": "almalinux 10",
      "fixedVersion": "3.1.10-8.el10_2.2",
      "fix": "ALSA-2026:19146",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19146",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-devel",
      "release": "almalinux 9",
      "fixedVersion": "3.1.1-3.el9_8.2",
      "fix": "ALSA-2026:19359",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19359",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-devel",
      "release": "amzn 2023",
      "fixedVersion": "3.1.5-1.amzn2023.0.9",
      "fix": "ALAS2023-2026-1612",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1612",
      "released": "2026-04-27T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-devel",
      "release": "ol 10",
      "fixedVersion": "0:3.1.10-8.el10_1.2",
      "fix": "ELSA-2026-15888",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-15888",
      "released": "2026-05-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-devel",
      "release": "ol 9",
      "fixedVersion": "0:3.1.1-3.el9_7.2",
      "fix": "ELSA-2026-15887",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-15887",
      "released": "2026-05-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-libs",
      "release": "RHEL 9",
      "fixedVersion": "0:3.1.1-3.el9_8.2",
      "fix": "RHSA-2026:19359",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-19359",
      "released": "2026-05-15T16:04:04Z"
    },
    {
      "platform": "linux",
      "product": "openexr-libs",
      "release": "almalinux 10",
      "fixedVersion": "3.1.10-8.el10_2.2",
      "fix": "ALSA-2026:19146",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19146",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-libs",
      "release": "almalinux 9",
      "fixedVersion": "3.1.1-3.el9_8.2",
      "fix": "ALSA-2026:19359",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19359",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-libs",
      "release": "amzn 2023",
      "fixedVersion": "3.1.5-1.amzn2023.0.9",
      "fix": "ALAS2023-2026-1612",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1612",
      "released": "2026-04-27T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-libs",
      "release": "ol 10",
      "fixedVersion": "0:3.1.10-8.el10_1.2",
      "fix": "ELSA-2026-15888",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-15888",
      "released": "2026-05-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-libs",
      "release": "ol 9",
      "fixedVersion": "0:3.1.1-3.el9_7.2",
      "fix": "ELSA-2026-15887",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-15887",
      "released": "2026-05-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openexr-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "3.1.5-1.amzn2023.0.9",
      "fix": "ALAS2023-2026-1612",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1612",
      "released": "2026-04-27T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}