PT-2026-21650 · Openexr · Openexr

Jungwoojjing · Publicado 2026-02-24 · Atualizado 2026-04-06 · CVE-2026-26981

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.6 OpenEXR versions 3.4.0 through 3.4.4

Description OpenEXR is an image storage format used in the motion picture industry. A heap-buffer-overflow (out-of-bounds read) can occur in the istream nonparallel read function within the ImfContextInit.cpp file when processing a specially crafted, malformed EXR file using a memory-mapped IStream. This happens because a negative value resulting from a signed integer subtraction is converted to size t, leading to an excessively large length being used in a memcpy operation.

Recommendations Update to OpenEXR version 3.3.7 or later. Update to OpenEXR version 3.4.5 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-195

Identificadores relacionados

CVE-2026-26981

GHSA-Q6VJ-WXVF-5M8C

OPENSUSE-SU-2026:10272-1

Produtos afetados

Openexr

Referências · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26981.json · Exploit
• https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef · Correção
• https://github.com/AcademySoftwareFoundation/openexr/commit/d2be382758adc3e9ab83a3de35138ec28d93ebd8 · Correção
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c · Aviso do Fabricante
• https://github.com/AcademySoftwareFoundation/openexr · Nota
• https://twitter.com/VulmonFeeds/status/2026299765877526907 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2026184611051819265 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26981 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-26981 · Nota
• https://osv.dev/vulnerability/GHSA-q6vj-wxvf-5m8c · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-26981 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2026:10272-1 · Aviso do Fabricante
• https://t.me/CVEtracker/45553 · Publicação no Telegram
• https://twitter.com/threatcluster/status/2033800597355233537 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-26981 · Aviso do Fabricante