CVE-2026-40244: OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internaldwacompressor.h:1722 performs curc->width curc->height in int32 arithmetic without a (sizet) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internaldwacompressor.h:1722.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40244?
CVE-2026-40244 is classified as a medium severity vulnerability due to the potential for integer overflow leading to memory corruption.
How do I fix CVE-2026-40244?
To fix CVE-2026-40244, upgrade OpenEXR to version 3.4.10 or later, or 3.3.10, or 3.2.8.
What versions are affected by CVE-2026-40244?
OpenEXR versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7 are affected by CVE-2026-40244.
What kind of vulnerability is CVE-2026-40244?
CVE-2026-40244 is an integer overflow vulnerability that affects pointer arithmetic in the DWA setupChannelData function.
Is CVE-2026-40244 a new issue?
CVE-2026-40244 is a missed variant of a previously reported vulnerability, CVE-2026-34589, indicating it is not a new issue but a related one.