{"id":"CVE-2026-27622","aliases":["GHSA-cr4v-6jm6-4963","PYSEC-2026-2846"],"url":"https://o3.security/vulnerability/CVE-2026-27622","summary":"OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write","details":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32.  overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.","published":"2026-03-03T22:42:49.086Z","modified":"2026-07-22T03:29:44.513053Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"openexr","fixedVersion":"3.2.6"},{"ecosystem":"PyPI","name":"openexr","fixedVersion":"3.3.8"},{"ecosystem":"PyPI","name":"openexr","fixedVersion":"3.4.6"}],"fix":null,"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27622.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12338"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12339"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12340"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12341"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16008"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16009"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7678"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7682"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8863"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8869"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8870"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8871"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8872"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8888"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-27622"},{"type":"ADVISORY","url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27622.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27622"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444251"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-22T03:29:44.513053Z"}}