CVE-2026-42216CWE-125

OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

High · published May 7, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00712 · 53.1th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-05-07T04:01Z
EPSS history
Timeline
  • 07 MAY 04:01Z
    OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
    cvelistv5