CVE-2026-26981
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
- State
- Published
- Severity
- 6.5 Medium
- Published
- Feb 24, 2026
- Updated
- Feb 24, 2026
- Reserved
- Feb 17, 2026
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | GitHub_M |
Weaknesses
- CWE-195 Signed to Unsigned Conversion Error
Affected Products
| Product | Versions |
|---|---|
openexrAcademySoftwareFoundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.