CVE-2026-34544

Affected versions of the openexr package are vulnerable to Out-of-bounds Write due to a signed integer overflow in the uncompress_b44_impl() function within internal_b44.c, where the row pointer arithmetic y * nx is computed using int types that overflow when the channel width is sufficiently large. The overflow causes the row pointers row0 through row3 to wrap to addresses before the scratch buffer, and subsequent memcpy() calls write decoded B44 pixel blocks to these invalid locations, producing a heap-based out-of-bounds write. An attacker can craft a malicious B44 or B44A EXR file that, when decoded via exr_decoding_run(), triggers a crash or potentially corrupts adjacent heap allocations.