{
  "cveId": "CVE-2026-40244",
  "url": "https://patchblox.com/security/cve/CVE-2026-40244",
  "summary": "CVE-2026-40244 is fixed in openexr on 1 platform by DEBIAN-CVE-2026-40244 (version 3.4.14-0.1), released April 21, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "openexr: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for t...",
  "description": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, \u0060internal_dwa_compressor.h:1722\u0060 performs \u0060curc-\u003Ewidth * curc-\u003Eheight\u0060 in \u0060int32\u0060 arithmetic without a \u0060(size_t)\u0060 cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses \u0060internal_dwa_compressor.h:1722\u0060.",
  "published": "2026-04-21T02:16:08Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
  "epss": 0.00427,
  "epssPercentile": 0.37155,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "openexr",
      "release": "Debian 14",
      "fixedVersion": "3.4.14-0.1",
      "fix": "DEBIAN-CVE-2026-40244",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-40244",
      "released": "2026-04-21T02:16:08Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}