Affected: Alpaquita:stream: openexr

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, sensitive information from heap memory may be leaked through the decoded pixel data (information disclosure). This occurs under default settings; simply reading a malicious EXR file is sufficient to trigger the issue, without any user interaction. This issue has been patched in version 3.4.8.

Affected: PyPI: openexr

### Summary The PXR24 decompression function undo_pxr24_impl in OpenEXR (internal_pxr24.c) ignores the actual decompressed size (outSize) returned by exr_uncompress_buffer() and instead reads from the scratch buffer based solely on the expected size (uncompressed_size) derived from the header metadata.

Additionally, exr_uncompress_buffer() (compression.c:202) treats LIBDEFLATE_SHORT_OUTPUT (where the compressed stream decompresses to fewer bytes than expected) as a successful result rather than an error.

When these two issues are combined, an attacker can craft a PXR24 EXR file containing a valid but truncated zlib stream. As a result, the decoder reads uninitialized heap memory and incorporates it into the output pixel data.

### Details This issue occurs due to the combination of two flaws.

1. compression.c:202–205 — LIBDEFLATE_SHORT_OUTPUT treated as success ``` else if (res == LIBDEFLATE_SHORT_OUTPUT) { /* TODO: is this an error? */ return EXR_ERR_SUCCESS; } ``` libdeflate_zlib_decompress_ex() returns LIBDEFLATE_SHORT_OUTPUT when the compressed stream is successfully decompressed but the resulting output size is smaller than the provided output buffer size. In this case, the actual number of decompressed bytes is written to actual_out. However, the function does not treat this condition as an error and instead returns success.

2. internal_pxr24.c:279–287 — outSize return value ignored ``` rstat = exr_uncompress_buffer( decode->context, compressed_data, co…

libIex-3_4-33-3.4.9-1.1 on GA media

Affected: PyPI: openexr

### Summary The PXR24 decompression function undo_pxr24_impl in OpenEXR (internal_pxr24.c) ignores the actual decompressed size (outSize) returned by exr_uncompress_buffer() and instead reads from the scratch buffer based solely on the expected size (uncompressed_size) derived from the header metadata.

Additionally, exr_uncompress_buffer() (compression.c:202) treats LIBDEFLATE_SHORT_OUTPUT (where the compressed stream decompresses to fewer bytes than expected) as a successful result rather than an error.

When these two issues are combined, an attacker can craft a PXR24 EXR file containing a valid but truncated zlib stream. As a result, the decoder reads uninitialized heap memory and incorporates it into the output pixel data.

### Details This issue occurs due to the combination of two flaws.

1. compression.c:202–205 — LIBDEFLATE_SHORT_OUTPUT treated as success ``` else if (res == LIBDEFLATE_SHORT_OUTPUT) { /* TODO: is this an error? */ return EXR_ERR_SUCCESS; } ``` libdeflate_zlib_decompress_ex() returns LIBDEFLATE_SHORT_OUTPUT when the compressed stream is successfully decompressed but the resulting output size is smaller than the provided output buffer size. In this case, the actual number of decompressed bytes is written to actual_out. However, the function does not treat this condition as an error and instead returns success.

2. internal_pxr24.c:279–287 — outSize return value ignored ``` rstat = exr_uncompress_buffer( decode->context, compressed_data, co…

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: openexr, Ubuntu:18.04:LTS: openexr, Ubuntu:Pro:20.04:LTS: openexr, Ubuntu:Pro:22.04:LTS: openexr, Ubuntu:24.04:LTS: openexr, Ubuntu:25.10: openexr, Ubuntu:26.04: openexr

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, sensitive information from heap memory may be leaked through the decoded pixel data (information disclosure). This occurs under default settings; simply reading a malicious EXR file is sufficient to trigger the issue, without any user interaction. This issue has been patched in version 3.4.8.