Buffer Overflow Vulnerability in OpenEXR Software from Academy Software Foundation
CVE-2026-40250
8.4HIGH
What is CVE-2026-40250?
Versions 3.2.0 through 3.4.9 of OpenEXR, a widely used image storage format for the film industry, are affected by a buffer overflow vulnerability. This issue arises from incorrect integer arithmetic within the internal_dwa_compressor.h file, leading to potential overflow conditions due to lack of proper type casting. It's important to upgrade to versions 3.2.8, 3.3.10, or 3.4.10, which include specific fixes addressing this flaw.
Affected Version(s)
openexr >= 3.2.0, < 3.2.8 < 3.2.0, 3.2.8
openexr >= 3.3.0, < 3.3.10 < 3.3.0, 3.3.10
openexr >= 3.4.0, < 3.4.10 < 3.4.0, 3.4.10