high 8.1

CVE-2026-42216 json

OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

published 2026-05-07 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-28298 , JLSEC-2026-810

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits: 0; none known

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

Patch / fix

fixed in 7 distros 6

julia OpenEXR_jll 3.4.12+0
Red Hat Red Hat Enterprise Linux 10 0:3.1.10-8.el10_2.3
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.1.10-8.el10_0.3
Red Hat Red Hat Enterprise Linux 9 0:3.1.1-3.el9_8.3
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:3.1.1-2.el9_2.4
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:3.1.1-2.el9_4.4
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.1.1-3.el9_6.3

debian red hat opensuse almalinux rocky linux alpine

openexr Debian 14 3.4.14-0.1

debian advisories DEBIAN-CVE-2026-42216

openexr RHEL 9 3.1.1-3.el9_8.3
openexr-libs RHEL 9 3.1.1-3.el9_8.3
openexr RHEL 10.2 3.1.10-8.el10_2.3
openexr-libs RHEL 10.2 3.1.10-8.el10_2.3
openexr RHEL 9.4 E4S 3.1.1-2.el9_4.4
openexr-libs RHEL 9.4 E4S 3.1.1-2.el9_4.4
openexr RHEL 9.2 E4S 3.1.1-2.el9_2.4
openexr-libs RHEL 9.2 E4S 3.1.1-2.el9_2.4

red hat advisories RHSA-2026:39026 RHSA-2026:39027 RHSA-2026:39024 RHSA-2026:39025 RHSA-2026:38498 RHSA-2026:38499

openexr openSUSE Tumbleweed 3.4.11-1.1

opensuse advisories openSUSE-SU-2026:10772-1

openexr AlmaLinux 9 3.1.1-3.el9_8.3
openexr-libs AlmaLinux 9 3.1.1-3.el9_8.3
openexr AlmaLinux 10 3.1.10-8.el10_2.3
openexr-libs AlmaLinux 10 3.1.10-8.el10_2.3

almalinux advisories ALSA-2026:38498 ALSA-2026:38499

openexr Rocky Linux 10 3.1.10-8.el10_2.3
openexr Rocky Linux 9 3.1.1-3.el9_8.3

rocky linux advisories RLSA-2026:38499 RLSA-2026:38498

openexr Alpine 3.22 3.3.11-r0
openexr Alpine 3.23 3.4.13-r0
openexr Alpine 3.24 3.4.11-r0

alpine advisories ALPINE-CVE-2026-42216

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42216 updated 2026-11-04 cvss 8.1

OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files

Red Hat Enterprise Linux 6 OpenEXR, OpenEXR-libs
affected: workaround, no fix planned “Will not fix”
Red Hat CodeReady Linux Builder EUS (v.9.6) openexr-devel 3.1.1-3.el9_6.3, openexr-debuginfo 3.1.1-3.el9_6.3, openexr-debugsource 3.1.1-3.el9_6.3, openexr-libs-debuginfo 3.1.1-3.el9_6.3
fixed: vendor fix RHSA-2026:39025
Red Hat Enterprise Linux AppStream (v. 9) openexr 3.1.1-3.el9_8.3, openexr-libs 3.1.1-3.el9_8.3
fixed: vendor fix RHSA-2026:38498
Red Hat Enterprise Linux AppStream (v. 10) openexr 3.1.10-8.el10_2.3, openexr-libs 3.1.10-8.el10_2.3
fixed: vendor fix RHSA-2026:38499
Red Hat Enterprise Linux AppStream E4S (v.9.2) openexr 3.1.1-2.el9_2.4, openexr-libs 3.1.1-2.el9_2.4
fixed: vendor fix RHSA-2026:39027
Red Hat Enterprise Linux AppStream E4S (v.9.4) openexr 3.1.1-2.el9_4.4, openexr-libs 3.1.1-2.el9_4.4
fixed: vendor fix RHSA-2026:39026
Red Hat Enterprise Linux AppStream EUS (v. 10.0) openexr 3.1.10-8.el10_0.3, openexr-libs 3.1.10-8.el10_0.3
fixed: vendor fix RHSA-2026:39024
Red Hat Enterprise Linux AppStream EUS (v.9.6) openexr 3.1.1-3.el9_6.3, openexr-libs 3.1.1-3.el9_6.3
fixed: vendor fix RHSA-2026:39025

show 6 more

Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) openexr-devel 3.1.1-3.el9_8.3, openexr-debuginfo 3.1.1-3.el9_8.3, openexr-debugsource 3.1.1-3.el9_8.3, openexr-libs-debuginfo 3.1.1-3.el9_8.3
fixed: vendor fix RHSA-2026:38498
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) openexr-devel 3.1.10-8.el10_2.3, openexr-debuginfo 3.1.10-8.el10_2.3, openexr-debugsource 3.1.10-8.el10_2.3, openexr-libs-debuginfo 3.1.10-8.el10_2.3
fixed: vendor fix RHSA-2026:38499
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) openexr-devel 3.1.10-8.el10_0.3, openexr-debuginfo 3.1.10-8.el10_0.3, openexr-debugsource 3.1.10-8.el10_0.3, openexr-libs-debuginfo 3.1.10-8.el10_0.3
fixed: vendor fix RHSA-2026:39024
Red Hat OpenShift AI 3.2 rhai/base-image-cpu-rhel9 1790703590, rhai/base-image-cpu-rhel9 1791232203, rhai/base-image-tpu-rhel9 1790703497, rhai/base-image-cuda-rhel9 1790703586, rhai/base-image-cuda-rhel9 1791232024, rhai/base-image-rocm-rhel9 1790703494, +3 more
fixed: vendor fix RHSA-2026:74460
Red Hat OpenShift AI 3.4 rhai/base-image-neuron-rhel9 1790703542
fixed: vendor fix RHSA-2026:74674
Red Hat Enterprise Linux 7 OpenEXR, OpenEXR-libs Red Hat Enterprise Linux 8 OpenEXR, OpenEXR-libs
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 6 mo ago (2026-05-07)

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-65j8-95g9-jgj4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
CISA ADP	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CNA	4.0	8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
OSV	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
julia	OpenEXR_jll	<3.4.12+0	3.4.12+0

Affected products

AcademySoftwareFoundation openexr
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat Red Hat Enterprise Linux 6
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8

Classification

Weakness

CWE-125 Out-of-bounds Read
CWE-130 Improper Handling of Length Parameter Inconsistency

References

github.com /AcademySoftwareFoundation/openexr/security/advisories/GHSA-65j8-95g9-jgj4
exploit, mitigation, vendor-advisory, web
access.redhat.com /errata/RHSA-2026:39024
vendor-advisory, web
access.redhat.com /errata/RHSA-2026:38499
vendor-advisory, web
access.redhat.com /errata/RHSA-2026:39027
vendor-advisory, web
access.redhat.com /errata/RHSA-2026:39026
vendor-advisory, web
access.redhat.com /errata/RHSA-2026:39025
vendor-advisory, web
access.redhat.com /errata/RHSA-2026:38498
vendor-advisory, web
access.redhat.com /security/cve/CVE-2026-42216
vdb-entry, web
bugzilla.redhat.com /show_bug.cgi?id=2467633
issue-tracking, web
security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-42216.json
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary