Integer Overflow Vulnerability in OpenEXR Products by Academy Software Foundation
CVE-2026-41142
8.8HIGH
What is CVE-2026-41142?
An integer overflow vulnerability exists in OpenEXR's ImageChannel::resize method, potentially leading to a heap out-of-bounds write through the OpenEXRUtil public API. This issue affects multiple versions of the OpenEXR library used extensively in the motion picture industry. It has been addressed in the patched releases, specifically versions 3.2.9, 3.3.11, and 3.4.11, ensuring improved security and system integrity.
Affected Version(s)
openexr >= 3.0.0, < 3.2.9 < 3.0.0, 3.2.9
openexr >= 3.3.0, < 3.3.11 < 3.3.0, 3.3.11
openexr >= 3.4.0, < 3.4.11 < 3.4.0, 3.4.11