PT-2026-38334 · Openexr · Openexr

M1-Llie · Published 2026-05-07 · Updated 2026-06-17 · CVE-2026-42216

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.0.0 through 3.2.8 OpenEXR versions 3.3.0 through 3.3.10 OpenEXR versions 3.4.0 through 3.4.10

Description The IDManifest::init() function reconstructs strings from a prefix-compressed representation. When a previous string exceeds 255 bytes, the subsequent string is expected to start with a 2-byte prefix length. The software reads the first two bytes of the current string without verifying that the string contains at least two bytes, leading to a buffer over-read (reading data beyond the end of the intended buffer).

Recommendations Update versions 3.0.0 through 3.2.8 to version 3.2.9. Update versions 3.3.0 through 3.3.10 to version 3.3.11. Update versions 3.4.0 through 3.4.10 to version 3.4.11.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-42216

ECHO-7BA5-1829-1400

OESA-2026-2364

OESA-2026-2365

OESA-2026-2366

OPENSUSE-SU-2026:10772-1

Affected Products

Openexr

References · 32

• 🔥 https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-65j8-95g9-jgj4 · Exploit
• https://osv.dev/vulnerability/OESA-2026-2364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42216 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42216 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42216 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2365 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-42216 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10772-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-42216 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42216 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42216 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42216 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41142 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42217 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-42216 · Vendor Advisory