CVE-2026-42216 Details

A high-severity out-of-bounds read vulnerability has been identified in OpenEXR versions 3.0.0 prior to 3.0.6, 3.1.0 prior to 3.1.14, 3.2.0 prior to 3.2.9, 3.3.0 prior to 3.3.11, and 3.4.0 prior to 3.4.11. The vulnerability arises in the IDManifest::init() function, where the code reconstructs strings from a prefix-compressed representation. If the preceding string exceeds 255 bytes, the subsequent string is expected to start with a 2-byte prefix length. However, the implementation fails to verify that the current string contains at least two bytes, leading to an out-of-bounds read. This flaw can be exploited to leak heap memory or cause a process crash by manipulating the prefix length derived from an empty string.

Users should update to OpenEXR versions 3.2.9, 3.3.11, or 3.4.11.