CVE-2026-42217

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger() decodes a variable-length integer from untrusted EXR input without bounding the shift count. After enough continuation bytes, the code executes a left shift by 70 on a 64-bit value, which is undefined behavior. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c	Patch
https://github.com/AcademySoftwareFoundation/openexr/pull/2378	Issue Tracking Patch
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openexr:openexr::::::::
	cpe:2.3:a:openexr:openexr::::::::
	cpe:2.3:a:openexr:openexr::::::::

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) OpenEXR proporciona la especificación y la implementación de referencia del formato de archivo EXR, un formato de almacenamiento de imágenes para la industria cinematográfica. Desde las versiones 3.0.0 hasta antes de la 3.2.9, 3.3.0 hasta antes de la 3.3.11, y 3.4.0 hasta antes de la 3.4.11, readVariableLengthInteger() decodifica un entero de longitud variable de una entrada EXR no confiable sin limitar el recuento de desplazamiento. Después de suficientes bytes de continuación, el código ejecuta un desplazamiento a la izquierda de 70 en un valor de 64 bits, lo cual es un comportamiento indefinido. Este problema ha sido parcheado en las versiones 3.2.9, 3.3.11 y 3.4.11.

Information

Published : 2026-05-07 04:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-42217

Mitre link : CVE-2026-42217

CVE.ORG link : CVE-2026-42217

JSON object : View

Products Affected

openexr

openexr

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-42217", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42217", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T12:07:53.292713Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "AcademySoftwareFoundation", "product": "openexr", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.2.9"}, {"status": "affected", "version": ">= 3.3.0, < 3.3.11"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.11"}]}]}], "published": "2026-05-07T04:16:34.387", "references": [{"url": "https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/AcademySoftwareFoundation/openexr/pull/2378", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger() decodes a variable-length integer from untrusted EXR input without bounding the shift count. After enough continuation bytes, the code executes a left shift by 70 on a 64-bit value, which is undefined behavior. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11."}, {"lang": "es", "value": "OpenEXR proporciona la especificaci\u00f3n y la implementaci\u00f3n de referencia del formato de archivo EXR, un formato de almacenamiento de im\u00e1genes para la industria cinematogr\u00e1fica. Desde las versiones 3.0.0 hasta antes de la 3.2.9, 3.3.0 hasta antes de la 3.3.11, y 3.4.0 hasta antes de la 3.4.11, readVariableLengthInteger() decodifica un entero de longitud variable de una entrada EXR no confiable sin limitar el recuento de desplazamiento. Despu\u00e9s de suficientes bytes de continuaci\u00f3n, el c\u00f3digo ejecuta un desplazamiento a la izquierda de 70 en un valor de 64 bits, lo cual es un comportamiento indefinido. Este problema ha sido parcheado en las versiones 3.2.9, 3.3.11 y 3.4.11."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CDF6C2E-6EC4-4383-8198-3769409030E6", "versionEndExcluding": "3.2.9", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8023AC7C-E2D1-4626-A4CC-585672ABAA66", "versionEndExcluding": "3.3.11", "versionStartIncluding": "3.3.0"}, {"criteria": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "079D2FDB-45A0-4382-8EFC-E95EA7430D0D", "versionEndExcluding": "3.4.11", "versionStartIncluding": "3.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}