Use of uninitialized resource in OpenEXR - #VU141330
Published: August 8, 2026
Vulnerability identifier: #VU141330
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-908
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and corrupt image data integrity.
The vulnerability exists due to use of an uninitialized resource in the scanline reader compact FrameBuffer handling when parsing a crafted ZIP-compressed scanline EXR file with a subsampled channel. A remote attacker can supply a specially crafted EXR file to disclose sensitive information and corrupt image data integrity.
User interaction is required to open or process the crafted EXR file.
Affected software
OpenEXR
Remediation
Install security update from vendor's website.
OpenEXR - addressed in versions 3.2.11, 3.3.13, 3.4.14