PT-2026-21650 · Openexr · Openexr

Jungwoojjing · Published 2026-02-24 · Updated 2026-04-06 · CVE-2026-26981

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.6 OpenEXR versions 3.4.0 through 3.4.4

Description OpenEXR is an image storage format used in the motion picture industry. A heap-buffer-overflow (out-of-bounds read) can occur in the istream nonparallel read function within the ImfContextInit.cpp file when processing a specially crafted, malformed EXR file using a memory-mapped IStream. This happens because a negative value resulting from a signed integer subtraction is converted to size t, leading to an excessively large length being used in a memcpy operation.

Recommendations Update to OpenEXR version 3.3.7 or later. Update to OpenEXR version 3.4.5 or later.

Exploit

Fix

Weakness Enumeration

CWE-195

Related Identifiers

CVE-2026-26981

GHSA-Q6VJ-WXVF-5M8C

OPENSUSE-SU-2026:10272-1

Affected Products

Openexr

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26981.json · Exploit
• https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef · Patch
• https://github.com/AcademySoftwareFoundation/openexr/commit/d2be382758adc3e9ab83a3de35138ec28d93ebd8 · Patch
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26981 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q6vj-wxvf-5m8c · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26981 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10272-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26981 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26981 · Security Note
• https://github.com/AcademySoftwareFoundation/openexr · Note
• https://twitter.com/VulmonFeeds/status/2026299765877526907 · Twitter Post
• https://twitter.com/CVEnew/status/2026184611051819265 · Twitter Post
• https://suse.com/security/cve/CVE-2026-26981 · Note