CVE-2026-41142

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-26)

CWE

CWE-190

Published

2026-05-07

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• openexr:openexr

References

• https://github.com/AcademySoftwareFoundation/openexr/commit/0592ee539f33c122c90f09238579b902d838afb4
• https://github.com/AcademySoftwareFoundation/openexr/pull/2367
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m25w-72cj-q6mg
• https://access.redhat.com/errata/RHSA-2026:38498
• https://access.redhat.com/errata/RHSA-2026:38499

Check your stackJSON