CVE-2026-42216

EUVD-2026-28298

07.05.2026, 04:16

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 37.89%

Affected Products (NVD)

Vendor	Product	Version
openexr	openexr	3.0.0 ≤ 𝑥 < 3.2.9
openexr	openexr	3.3.0 ≤ 𝑥 < 3.3.11
openexr	openexr	3.4.0 ≤ 𝑥 < 3.4.11

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Enterprise Linux 10	0:3.1.10-8.el10_2.3 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	0:3.1.10-8.el10_0.3 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	0:3.1.1-3.el9_8.3 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	0:3.1.1-2.el9_2.4 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	0:3.1.1-2.el9_4.4 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	0:3.1.1-3.el9_6.3 ≤ 𝑥 < *	ADP