OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.7, an attacker providing a crafted .exr file with HTJ2K compression and a channel width of 32768 can write controlled data beyond the output heap buffer in any application that decodes EXR images. The write primitive is 2 bytes per overflow iteration or 4 bytes (by another path), repeating for each additional pixel past the overflow point. In this context, a heap write overflow can lead to remote code execution on systems. This issue has been patched in version 3.4.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenEXR provides the specification and reference implementation of the EXR file format, an image storage
    format for the motion picture industry. From version 3.4.0 to before version 3.4.7, an attacker providing
    a crafted .exr file with HTJ2K compression and a channel width of 32768 can write controlled data beyond
    the output heap buffer in any application that decodes EXR images. The write primitive is 2 bytes per
    overflow iteration or 4 bytes (by another path), repeating for each additional pixel past the overflow
    point. In this context, a heap write overflow can lead to remote code execution on systems. This issue has
    been patched in version 3.4.7. (CVE-2026-34545)

The version of the OpenEXR Python package installed on the remote host is 3.4.x prior to 3.4.7.
It is, therefore, affected by a heap buffer overflow vulnerability:

  - A heap-buffer-overflow (out-of-bounds read) occurs in the the HTJ2K decoder in OpenEXR     when copying decompressed samples from OpenJPH buffers into the EXR output buffer.     (CVE-2026-34545)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenEXR provides the specification and reference implementation of the EXR file format, an image storage     format for the motion picture industry. From version 3.4.0 to before version 3.4.7, an attacker providing     a crafted .exr file with HTJ2K compression and a channel width of 32768 can write controlled data beyond     the output heap buffer in any application that decodes EXR images. The write primitive is 2 bytes per     overflow iteration or 4 bytes (by another path), repeating for each additional pixel past the overflow     point. In this context, a heap write overflow can lead to remote code execution on systems. This issue has     been patched in version 3.4.7. (CVE-2026-34545)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464270	Echo: openexr: security update to 3.1.13-2	Tenable Cloud Security	Echo Local Security Checks	Local	high
464270	Echo: openexr: security update to 3.1.13-2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
304814	Python Library OpenEXR 3.4.x < 3.4.7 Heap Buffer Overflow (OOB Read)	Nessus	Misc.	Local	high
304702	Linux Distros Unpatched Vulnerability : CVE-2026-34545	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-34545

high

Tenable Plugins

high

high

high

high