Vulnerability · Published May 7, 2026 · Assigned by GitHub_M
CVE-2026-42216OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
High 8.1
In plain English
A high-severity out-of-bounds read in openexr from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | openexr | 3.1.10-8.el10_2.3 | ALSA-2026:38499 |
| AlmaLinux:9 | openexr | 3.1.1-3.el9_8.3 | ALSA-2026:38498 |
| AlmaLinux:10 | openexr-devel | 3.1.10-8.el10_2.3 | ALSA-2026:38499 |
| AlmaLinux:9 | openexr-devel | 3.1.1-3.el9_8.3 | ALSA-2026:38498 |
| AlmaLinux:10 | openexr-libs | 3.1.10-8.el10_2.3 | ALSA-2026:38499 |
| AlmaLinux:9 | openexr-libs | 3.1.1-3.el9_8.3 | ALSA-2026:38498 |
| Alpine:v3.22 | openexr | 3.3.11-r0 | ALPINE-CVE-2026-42216 |
| Alpine:v3.23 | openexr | 3.4.13-r0 | ALPINE-CVE-2026-42216 |
| Alpine:v3.24 | openexr | 3.4.11-r0 | ALPINE-CVE-2026-42216 |
| Debian:12 | openexr | no fix listed | DEBIAN-CVE-2026-42216 |
| Debian:13 | openexr | no fix listed | DEBIAN-CVE-2026-42216 |
| Debian:14 | openexr | 3.4.14-0.1 | DEBIAN-CVE-2026-42216 |
| Rocky Linux:10 | openexr | 0:3.1.10-8.el10_2.3 | RLSA-2026:38499 |
| Rocky Linux:9 | openexr | 0:3.1.1-3.el9_8.3 | RLSA-2026:38498 |
| Ubuntu:25.10 | openexr | no fix listed | UBUNTU-CVE-2026-42216 |
| Ubuntu:26.10 | openexr | no fix listed | UBUNTU-CVE-2026-42216 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.0.0, < 3.2.9>= 3.3.0, < 3.3.11>= 3.4.0, < 3.4.11 |
Weakness: CWE-125, CWE-130 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-65j8-95g9-jgj4 x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-42216 vdb-entry, x_refsource_REDHAT
- RHBZ#2467633 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42216.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:39024 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:38499 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39027 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39026 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39025 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:38498 vendor-advisory, x_refsource_REDHAT