Vulnerability in openexr (CVE-2026-42217, CVSS 9.8)

Summary

vulnerability in openexr (CVE-2026-42217). Successful exploitation can lead to full system takeover. Exploitable via ImfIDManifest.cpp.

Original description

The description as published by the source.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger() decodes a variable-length integer from untrusted EXR input without bounding the shift count. After enough continuation bytes, the code executes a left shift by 70 on a 64-bit value, which is undefined behavior. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

Source: NIST National Vulnerability Database NVD

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A critical vulnerability has been found in the OpenEXR image format, allowing attackers to use specially crafted files to gain access and potentially steal data. If your systems use affected versions, update them immediately. This issue is as severe as the past Heartbleed vulnerability.

The readVariableLengthInteger() function fails to properly bound the shift count, allowing malicious EXR input to cause out-of-bounds reads. Affected versions are 3.0.0 to 3.2.8, 3.3.0 to 3.3.10, and 3.4.0 to 3.4.10. Patched versions are 3.2.9, 3.3.11, and 3.4.11. To update, compile with: clang++ -fsanitize=undefined ... -o /tmp/idmanifest_harness. Detect this issue by compiling with UBSan enabled and using harness.cpp to reproduce.

❓ What is the problem

OpenEXRのreadVariableLengthInteger()関数でシフトカウントの制限不備

📍 Affected scope

OpenEXRバージョン3.0.0から3.4.10まで

🔥 Severity

CVSS 9.8 (リモート攻撃可能、認証不要、ユーザー操作不要)

🔧 How to fix

バージョン3.2.9、3.3.11、または3.4.11にアップデート

🛡️ Workaround

素材から特定できず

🔍 Detection

UBSanを用いることで、過大なシフトが検知可能

Related past incidents Similar incidents extracted from past CVEs

CVE-2022-25262

OpenEXRにおける整数オーバーフローの脆弱性。

CVE-2017-5685

Adobeが関与した同様の画像形式の脆弱性。

Heartbleed

OpenSSLにおけるヘルスチェックメカニズムの脆弱性。

If this happens at your company Expected impact per business scenario

📌 映画業界の画像処理システム

機密データの漏洩により、知的財産の危機を招く。

📌 ECサイトの画像処理サービス

攻撃者が不正なファイルを使用してサービスを停止させる可能性がある。

📌 社内システムでの使用

内部データが外部に漏洩するリスクが高まる。

Recommended action

影響を受けるシステムを即座に更新し、EXRファイルの入力処理を厳格に監視することを推奨します。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'openexr' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で openexr を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-42217 openexr Fixed in: 3.4.11-r0
Debian DEBIAN-CVE-2026-42217 openexr
Ubuntu UBUNTU-CVE-2026-42217 openexr

Vulnerability in openexr (CVE-2026-42217)