OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API (AcademySoftwareFoundation openexr)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.44 % · percentile 38 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
Weaknesses (CWE)
- CWE-190 — Integer Overflow or Wraparound
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m25w-72cj-q6mg
- https://github.com/AcademySoftwareFoundation/openexr/pull/2367
- https://github.com/AcademySoftwareFoundation/openexr/commit/0592ee539f33c122c90f09238579b902d838afb4
- https://access.redhat.com/security/cve/CVE-2026-41142
- https://bugzilla.redhat.com/show_bug.cgi?id=2467623
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41142.json
- https://access.redhat.com/errata/RHSA-2026:39024
- https://access.redhat.com/errata/RHSA-2026:38499
- https://access.redhat.com/errata/RHSA-2026:39027
- https://access.redhat.com/errata/RHSA-2026:39026
- https://access.redhat.com/errata/RHSA-2026:39025
- https://access.redhat.com/errata/RHSA-2026:38498
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | GitHub_M |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | redhat-SADP |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
European references
- ENISA EUVD · EUVD-2026-28251
- GCVE · GCVE-0-2026-41142
Affected configurations (NVD CPE)
cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.2.9cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*≥ 3.3.0 < 3.3.11cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.11
Affected products
| Product | Versions |
|---|---|
| AcademySoftwareFoundation · openexr | affected >= 3.0.0, < 3.2.9 ; affected >= 3.3.0, < 3.3.11 ; affected >= 3.4.0, < 3.4.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |