CVE-2026-34543

Affected versions of the openexr package are vulnerable to Information Disclosure due to the undo_pxr24_impl() function in internal_pxr24.c ignoring the actual decompressed size returned by exr_uncompress_buffer() and instead reading from the scratch buffer based on the header-derived expected size, combined with exr_uncompress_buffer() in compression.c treating LIBDEFLATE_SHORT_OUTPUT as a successful result rather than an error. When a crafted PXR24 EXR file contains a valid but truncated zlib stream, the decompressor writes fewer bytes than expected to the scratch buffer while the subsequent byte-plane reconstruction loop reads the full expected size, incorporating uninitialised heap memory into the output pixel data. An attacker can craft a malicious EXR file that, when decoded under default settings, leaks sensitive heap memory contents through the rendered pixel output.