Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

OpenEXR fails to validate image file data, potentially causing crashes.

CVE-2026-42216 · published 4 months ago
Summary

OpenEXR, used in the motion picture industry, has a bug that can cause crashes when processing certain image files. This bug affects versions 3.0.0 to 3.2.9, 3.3.0 to 3.3.11, and 3.4.0 to 3.4.10. To fix this, update to version 3.2.9, 3.3.11, or 3.4.11.

What to do
  • Update debian rootio-openexr to version 3.1.13-2.aikido.15.
  • Update bellsoft openexr to version 3.4.11-r0.
  • Update debian rootio-openexr to version 3.1.5-5.root.io.22.
  • Update debian rootio-openexr to version 3.1.13-2.root.io.12.
  • Update debian openexr to version 3.1.13-2.aikido.15.
  • Update debian rootio-openexr to version 2.5.4-2+deb11u1.root.io.14.
  • Update debian openexr to version 2.5.4-2+deb11u1.root.io.15.
  • Update debian rootio-openexr to version 2.5.4-2+deb11u1.root.io.15.
  • Update debian openexr to version 2.5.4-2+deb11u1.aikido.18.
  • Update debian rootio-openexr to version 2.5.4-2+deb11u1.aikido.18.
  • Update debian rootio-openexr to version 3.1.5-5.aikido.25.
  • Update debian rootio-openexr to version 3.1.5-5.root.io.23.
  • Update debian openexr to version 3.1.5-5.aikido.25.
  • Update debian openexr to version 3.1.13-2.root.io.12.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian openexr All versions
Debian:12 debian openexr All versions
Debian:13 debian openexr All versions
Debian:14 debian openexr All versions
Root:Debian:13 debian rootio-openexr < 3.1.13-2.aikido.15
< 3.1.13-2.root.io.12
Fix: upgrade to 3.1.13-2.aikido.15
– openexr openexr >= 3.0.0, < 3.2.9
>= 3.3.0, < 3.3.11
>= 3.4.0, < 3.4.11
cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*
Alpaquita:stream bellsoft openexr >= 3.4.4-r0, < 3.4.11-r0
Fix: upgrade to 3.4.11-r0
Root:Debian:12 debian rootio-openexr < 3.1.5-5.root.io.22
< 3.1.5-5.aikido.25
< 3.1.5-5.root.io.23
Fix: upgrade to 3.1.5-5.root.io.22
– academysoftwarefoundation openexr >= 3.0.0, < 3.2.9
Root:Debian:13 debian openexr < 3.1.13-2.aikido.15
< 3.1.13-2.root.io.12
Fix: upgrade to 3.1.13-2.aikido.15
Root:Debian:11 debian rootio-openexr < 2.5.4-2+deb11u1.root.io.14
< 2.5.4-2+deb11u1.root.io.15
< 2.5.4-2+deb11u1.aikido.18
Fix: upgrade to 2.5.4-2+deb11u1.root.io.14
Root:Debian:11 debian openexr < 2.5.4-2+deb11u1.root.io.15
< 2.5.4-2+deb11u1.aikido.18
Fix: upgrade to 2.5.4-2+deb11u1.root.io.15
Root:Debian:12 debian openexr < 3.1.5-5.aikido.25
Fix: upgrade to 3.1.5-5.aikido.25
Original advisory text
OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
References
Severity
9.1 Critical
CVSS 4.0: 8.8 (NVD)
CVSS 4.0: 9.1 (OSV)
CVSS 3.1: 9.1 (OSV)
Exploitation
EPSS <1%
Type
CWE-125Out-of-bounds Read
CWE-130Improper Handling of Length Parameter Inconsistency
Timeline
Published7 May 2026
Updated25 Sep 2026
First seen7 May 2026
Sources
DEBIAN-CVE-2026-42216 · OSV
ROOT-OS-DEBIAN-12-CVE-2026-42216 · OSV
BELL-CVE-2026-42216 · OSV
ROOT-OS-DEBIAN-11-CVE-2026-42216 · OSV
ROOT-OS-DEBIAN-13-CVE-2026-42216 · OSV
CVE-2026-42216 · NVD
CVE-2026-42216 · MITRE
GHSA-65j8-95g9-jgj4 · GHSA
CVE-2026-42216 · OSV
Track software like this
Free during beta