CVE-2026-41142

HIGH 8.8

OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

CWE	CWE-190
Vendor	academysoftwarefoundation
Product	openexr
Published	May 7, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for academysoftwarefoundation openexr

Be the first to know when new high vulnerabilities affecting academysoftwarefoundation openexr are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

AcademySoftwareFoundation / openexr

>= 3.0.0, < 3.2.9 >= 3.3.0, < 3.3.11 >= 3.4.0, < 3.4.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗