CVE-2026-34588

Affected versions of the OpenEXR package are vulnerable to Out-of-bounds Read and Write due to a signed 32-bit integer overflow in the PIZ decoder’s wavelet buffer pointer advancement within internal_exr_undo_piz() in internal_piz.c. The expression wavbuf += nx * ny * wcount is computed using signed int arithmetic, and a crafted EXR file can cause this product to overflow and wrap, positioning the working pointer outside the allocated scratch buffer so that subsequent wavelet decode operations in wdec14_4() read from and write to out-of-bounds heap memory. An attacker can supply a specially crafted EXR file to trigger heap memory corruption, potentially leading to process crash or further exploitation outcomes depending on allocator layout.