Integer overflow in OpenEXR - CVE-2026-42217

Vulnerability identifier: #VU129653

CSH Severity: Medium

CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42217

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.

The vulnerability exists due to integer overflow or wraparound in readVariableLengthInteger() in ImfIDManifest.cpp when parsing a crafted EXR file containing an idmanifest attribute. A remote attacker can supply a specially crafted EXR file to cause a denial of service and disclose sensitive information.

The corrupted return value is used as a string-list length in readStringList(), which can lead to reads beyond the end of the supplied buffer. User interaction is required to open or process the crafted EXR file.

OpenEXR
openEuler
Anolis OS
OpenEXR-libs
OpenEXR-devel
OpenEXR-debugsource
OpenEXR-debuginfo
OpenEXR
OpenEXR-doc

Install security update from vendor's website.

OpenEXR - addressed in versions 3.2.9, 3.3.11, 3.4.11
OpenEXR-libs - addressed in versions 3.1.5-7, 3.1.11-9
OpenEXR-devel - addressed in versions 3.1.5-7, 3.1.11-9
OpenEXR-debugsource - addressed in versions 3.1.5-7, 3.1.11-9
OpenEXR-debuginfo - addressed in versions 3.1.5-7, 3.1.11-9
OpenEXR - addressed in versions 3.1.5-7, 3.1.11-9
OpenEXR-devel - update to 3.4.10-2
OpenEXR-doc - update to 3.4.10-2
OpenEXR-libs - update to 3.4.10-2
OpenEXR - update to 3.4.10-2

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m

• Multiple vulnerabilities in OpenEXR
• Anolis OS update for OpenEXR
• openEuler 24.03 LTS SP3 update for OpenEXR
• openEuler 24.03 LTS update for OpenEXR
• openEuler 22.03 LTS SP4 update for OpenEXR
• openEuler 24.03 LTS SP1 update for OpenEXR