OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, `internal_dwa_compressor.h:1040` performs `chan->width * chan->bytes_per_element` in `int32` arithmetic without a `(size_t)` cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses `internal_dwa_compressor.h:1040`.

N/A

整数溢出或超界折返

OpenEXR 输入验证错误漏洞

OpenEXR是Academy Software Foundation开源的一种高动态范围图像（HDR）文件格式的开放标准。 OpenEXR 3.4.0版本至3.4.9版本、3.3.0版本至3.3.9版本和3.2.0版本至3.2.7版本存在输入验证错误漏洞，该漏洞源于internal_dwa_compressor.h:1040行在int32算术中执行chan->width * chan->bytes_per_element运算时未进行(size_t)强制转换，可能导致整数溢出。

N/A

N/A