CVE-2026-40250: OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internaldwacompressor.h:1040 performs chan->width chan->bytesperelement in int32 arithmetic without a (sizet) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internaldwacompressor.h:1040.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40250?
The severity of CVE-2026-40250 is considered high due to the potential for exploitation through integer overflow leading to memory corruption.
How do I fix CVE-2026-40250?
To fix CVE-2026-40250, you should upgrade to OpenEXR versions 3.4.10 or later, or 3.3.10 or later.
Which versions of OpenEXR are affected by CVE-2026-40250?
CVE-2026-40250 affects OpenEXR versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7.
What type of vulnerability is CVE-2026-40250?
CVE-2026-40250 is an integer overflow vulnerability specifically in the DWA decoder outBufferEnd pointer arithmetic.
Can CVE-2026-40250 lead to remote code execution?
Yes, the exploitation of CVE-2026-40250 could potentially allow an attacker to execute arbitrary code remotely.