CVE-2026-34589

Affected versions of the OpenEXR package are vulnerable to Out-of-bounds Write due to a signed 32-bit integer overflow in the DWA lossy decoder’s per-component block pointer construction within internal_dwa_decoder.h. The expression numBlocksX * 64, computed as signed int, overflows for sufficiently large image widths, causing rowBlock pointers to wrap and point outside the allocated rowBlockHandle buffer, so that LossyDctDecoder_execute() subsequently writes to out-of-bounds heap memory. An attacker can supply a crafted DWAA-compressed EXR file to trigger heap memory corruption during decompression, potentially leading to process crash or further exploitation.