Out-of-bounds write in OpenEXR - #VU141336
Published: August 8, 2026
Vulnerability identifier: #VU141336
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service and modify memory.
The vulnerability exists due to out-of-bounds write in the exrmetrics scanline channel buffer handling when parsing a crafted public scanline EXR file on ILP32 builds. A remote attacker can trick the victim into opening a crafted file to cause a denial of service and modify memory.
User interaction is required to open the crafted EXR file. Only ILP32 builds in exrmetrics workflows are vulnerable, while LP64 builds do not truncate the allocation in the same way.
Affected software
OpenEXR
Remediation
Install security update from vendor's website.
OpenEXR - addressed in versions 3.3.13, 3.4.14