CVE-2026-41142

HIGH8.8

OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API

Published May 7, 2026

Modified 4 weeks ago

Details

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

References

WEB

https://github.com/AcademySoftwareFoundation/openexr/commit/0592ee539f33c122c90f09238579b902d838afb4

WEB

https://github.com/AcademySoftwareFoundation/openexr/pull/2367

WEB

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m25w-72cj-q6mg

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-41142

CVSS Analysis

CVSS v3.1

8.8