OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp (AcademySoftwareFoundation openexr)
En bref
- Source
- NVD
- EPSS
- EPSS 0.60 % · centile 49 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Analyzed
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch.
Faiblesses (CWE)
- CWE-195 — Signed to Unsigned Conversion Error
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | GitHub_M |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | NVD · security-advisories@github.com (Secondary) |
Avis
- GHSA-q6vj-wxvf-5m8c — OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
- PYSEC-2026-2849 — OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
Références européennes
- ENISA EUVD · EUVD-2026-7407
- GCVE · GCVE-0-2026-26981
Avis du CERT-FR
- CERTFR-2026-AVI-0281 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*≥ 3.3.0 < 3.3.7cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.5
Produits affectés
| Produit | Versions |
|---|---|
| AcademySoftwareFoundation · openexr | affected >= 3.3.0, < 3.3.7 ; affected >= 3.4.0, < 3.4.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |