Out-of-Bounds Read in openexr (CVE-2026-42216, CVSS 9.1)

Summary

vulnerability in openexr (CVE-2026-42216). Confidential information can be exposed externally. Exploitable via c13e0e1320a6652e02c5c90c6dbd984d532efe44.

Original description

The description as published by the source.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

Source: NIST National Vulnerability Database NVD

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A critical flaw was discovered in OpenEXR, a software used for handling image formats. This flaw allows attackers to illicitly view data from memory or cause a system crash by manipulating certain files. Similar defects have previously led to exploited attacks in enterprise systems, particularly affecting the film industry. Updating to the recommended versions immediately can mitigate the risks.

The bug in the IDManifest::init() function occurs in OpenEXR versions 3.0.0 to 3.4.10. It lacks length checks for stringList[i][0] and stringList[i][1], allowing out-of-bounds reads, particularly problematic with strings over 255 bytes. The issue is resolved in versions 3.2.9, 3.3.11, and 3.4.11. Attackers can exploit this flaw to leak data from heap memory or cause DOS. No workaround is provided, so upgrading is critical.

❓ What is the problem

The vulnerability is in the IDManifest::init() function of OpenEXR, which reconstructs strings from a prefix-compressed representation without proper length checks.

📍 Affected scope

The issue is in src/lib/OpenEXR/ImfIDManifest.cpp on lines 342-343 and 346-347.

🔥 Severity

The vulnerability allows for remote exploitation without authentication or user interaction, leading to information disclosure or denial of service, classified as critical with a CVSS score of 9.1.

🔧 How to fix

Upgrade OpenEXR to versions 3.2.9, 3.3.11, or 3.4.11.

🛡️ Workaround

No workaround is provided in the sources.

🔍 Detection

Monitor for unusual memory access patterns when processing EXR files, especially those exceeding 255 bytes in length.

Related past incidents Similar incidents extracted from past CVEs

CVE-2021-20296

A buffer overflow in OpenEXR's PyBufImage::read() function could also lead to memory disruptions.

CVE-2020-11758

Another OpenEXR out-of-bounds read allowed similar heap memory exposure.

Heartbleed

This vulnerability also involved an out-of-bounds read, resulting in critical data exposure.

If this happens at your company Expected impact per business scenario

📌 An animation studio using OpenEXR files for rendering.

An attacker could crash the rendering system, delaying production timelines.

📌 A VFX company with a large archive of EXR files.

If exploited, data leaks could reveal proprietary image content.

📌 A cloud service provider hosting EXR files.

Potential for DOS attacks against the hosting service, impacting multiple clients.

Recommended action

Implement the patches as soon as possible by updating to the fixed OpenEXR versions to mitigate the vulnerabilities.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'openexr' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で openexr を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-42216 openexr Fixed in: 3.4.11-r0
Debian DEBIAN-CVE-2026-42216 openexr
Ubuntu UBUNTU-CVE-2026-42216 openexr

Out-of-Bounds Read in openexr (CVE-2026-42216)