← CVE Intelligence

CVE-2026-42216

OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion PUBLISHED

Description (CNA)

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

Affected (CNA)

Vendor / productVersions
AcademySoftwareFoundation / openexraffected >= 3.0.0, < 3.2.9; affected >= 3.3.0, < 3.3.11; affected >= 3.4.0, < 3.4.11

CWE

CWE-125

References

ADP enrichment

CISA-ADP

No English description supplied.

redhat-SADP

A flaw was found in OpenEXR. A remote attacker could exploit a vulnerability in the IDManifest::init() function when processing specially crafted EXR files. The function attempts to reconstruct strings from a prefix-compressed representation. If a previous string exceeds 255 bytes, the subsequent string is expected to have a 2-byte prefix length. However, the code reads these bytes without validating that the current string has at least two bytes, which could lead to information disclosure or a denial of service (DoS).