PT-2026-38335 · Openexr · Openexr

M1-Llie · Published 2026-05-07 · Updated 2026-06-08 · CVE-2026-42217

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.0.0 through 3.2.8 OpenEXR versions 3.3.0 through 3.3.10 OpenEXR versions 3.4.0 through 3.4.10

Description The readVariableLengthInteger() function decodes a variable-length integer from untrusted EXR input without bounding the shift count. When a sufficient number of continuation bytes are processed, the code performs a left shift by 70 on a 64-bit value, resulting in undefined behavior.

Recommendations Update versions 3.0.0 through 3.2.8 to version 3.2.9. Update versions 3.3.0 through 3.3.10 to version 3.3.11. Update versions 3.4.0 through 3.4.10 to version 3.4.11.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-42217

ECHO-E186-1AAB-8C05

OESA-2026-2364

OESA-2026-2365

OESA-2026-2366

OPENSUSE-SU-2026:10772-1

Affected Products

Openexr

References · 33

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m · Vendor Advisory
• https://github.com/AcademySoftwareFoundation/openexr/pull/2378 · Patch
• https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c · Patch
• https://osv.dev/vulnerability/OESA-2026-2365 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42217 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-42217 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-42217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42216 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42217 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42217 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41142 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-42217 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42217 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2364 · Vendor Advisory