CVE-2026-26981 PUBLISHED

OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

Assigner: GitHub_M
Reserved: 17.02.2026 Published: 24.02.2026 Updated: 24.02.2026

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the istream_nonparallel_read function in ImfContextInit.cpp when parsing a malformed EXR file through a memory-mapped IStream. A signed integer subtraction produces a negative value that is implicitly converted to size_t, resulting in a massive length being passed to memcpy. Versions 3.3.7 and 3.4.5 contain a patch.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Product Status

Vendor AcademySoftwareFoundation
Product openexr
Versions
  • Version >= 3.3.0, < 3.3.7 is affected
  • Version >= 3.4.0, < 3.4.5 is affected

References

Problem Types

  • CWE-195: Signed to Unsigned Conversion Error CWE