Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

CVE-2026-42216: OpenEXR fails to validate image file data, potentially causing crashes.

CVE-2026-42216 CVE-2026-42216
Summary

OpenEXR, used in the motion picture industry, has a bug that can cause crashes when processing certain image files. This bug affects versions 3.0.0 to 3.2.9, 3.3.0 to 3.3.11, and 3.4.0 to 3.4.10. To fix this, update to version 3.2.9, 3.3.11, or 3.4.11.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software
VendorProductAffected versions
openexr openexr >= 3.0.0, < 3.2.9
>= 3.3.0, < 3.3.11
>= 3.4.0, < 3.4.11
cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*
academysoftwarefoundation openexr >= 3.0.0, < 3.2.9
Original title
OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
Original description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
nvd CVSS4.0 8.8
Vulnerability type
CWE-125 Out-of-bounds Read
CWE-130
Published: 7 May 2026 · Updated: 23 Jul 2026 · First seen: 7 May 2026