CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCVE-2026-26981
Medium (6.5) in openexr openexr. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in openexr 3.3.7, 3.4.5.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
- CWE
- CWE-195
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openexr:openexr
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q6vj-wxvf-5m8c | PyPI | openexr | >=3.3.0 <3.3.7 | 3.3.7 |
| GHSA-q6vj-wxvf-5m8c | PyPI | openexr | >=3.4.0 <3.4.5 | 3.4.5 |
| PYSEC-2026-2849 | PyPI | openexr | >=3.3.0 <3.3.7 >=3.4.0 <3.4.5 | 3.3.7, 3.4.5 |