CVE-2026-42216: OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-07 · updated 2026-10-26
Weakness: CWE-125

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

Affected products

AcademySoftwareFoundation openexr: from 3.0.0 before 3.2.9; from 3.3.0 before 3.3.11; from 3.4.0 before 3.4.11 — fixed in 3.2.9, 3.3.11, 3.4.11

How to fix

Upgrade to a fixed version: AcademySoftwareFoundation openexr 3.2.9, 3.3.11, 3.4.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-42216 or the next vulnerability affects your stack