Log in Start free

Vulnerability · Published May 7, 2026 · Assigned by GitHub_M

CVE-2026-42217OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)

Medium 6.3

In plain English

A medium-severity integer overflow in openexr from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.4%top 66.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger() decodes a variable-length integer from untrusted EXR input without bounding the shift count. After enough continuation bytes, the code executes a left shift by 70 on a 64-bit value, which is undefined behavior. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22openexr3.3.11-r0ALPINE-CVE-2026-42217
Alpine:v3.23openexr3.4.13-r0ALPINE-CVE-2026-42217
Alpine:v3.24openexr3.4.11-r0ALPINE-CVE-2026-42217
Debian:12openexrno fix listedDEBIAN-CVE-2026-42217
Debian:13openexrno fix listedDEBIAN-CVE-2026-42217
Debian:14openexr3.4.14-0.1DEBIAN-CVE-2026-42217
Ubuntu:25.10openexrno fix listedUBUNTU-CVE-2026-42217
Ubuntu:26.10openexrno fix listedUBUNTU-CVE-2026-42217

Affected products (as reported)

VendorProductVersions
AcademySoftwareFoundation openexr >= 3.0.0, < 3.2.9>= 3.3.0, < 3.3.11>= 3.4.0, < 3.4.11

Weakness: CWE-190 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References