Vulnerability · Published May 7, 2026 · Assigned by GitHub_M
CVE-2026-41142OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
High 8.8
In plain English
A high-severity integer overflow in openexr from AcademySoftwareFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | openexr | 3.1.10-8.el10_2.3 | ALSA-2026:38499 |
| AlmaLinux:9 | openexr | 3.1.1-3.el9_8.3 | ALSA-2026:38498 |
| AlmaLinux:10 | openexr-devel | 3.1.10-8.el10_2.3 | ALSA-2026:38499 |
| AlmaLinux:9 | openexr-devel | 3.1.1-3.el9_8.3 | ALSA-2026:38498 |
| AlmaLinux:10 | openexr-libs | 3.1.10-8.el10_2.3 | ALSA-2026:38499 |
| AlmaLinux:9 | openexr-libs | 3.1.1-3.el9_8.3 | ALSA-2026:38498 |
| Alpine:v3.22 | openexr | 3.3.11-r0 | ALPINE-CVE-2026-41142 |
| Alpine:v3.23 | openexr | 3.4.13-r0 | ALPINE-CVE-2026-41142 |
| Alpine:v3.24 | openexr | 3.4.11-r0 | ALPINE-CVE-2026-41142 |
| Debian:12 | openexr | no fix listed | DEBIAN-CVE-2026-41142 |
| Debian:13 | openexr | no fix listed | DEBIAN-CVE-2026-41142 |
| Debian:14 | openexr | 3.4.14-0.1 | DEBIAN-CVE-2026-41142 |
| Rocky Linux:10 | openexr | 0:3.1.10-8.el10_2.3 | RLSA-2026:38499 |
| Rocky Linux:9 | openexr | 0:3.1.1-3.el9_8.3 | RLSA-2026:38498 |
| Ubuntu:25.10 | openexr | no fix listed | UBUNTU-CVE-2026-41142 |
| Ubuntu:26.10 | openexr | no fix listed | UBUNTU-CVE-2026-41142 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.0.0, < 3.2.9>= 3.3.0, < 3.3.11>= 3.4.0, < 3.4.11 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m25w-72cj-q6mg x_refsource_CONFIRM
- https://github.com/AcademySoftwareFoundation/openexr/pull/2367 x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/commit/0592ee539f33c122c90f09238579b902d838afb4 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-41142 vdb-entry, x_refsource_REDHAT
- RHBZ#2467623 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41142.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:39024 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:38499 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39027 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39026 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39025 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:38498 vendor-advisory, x_refsource_REDHAT