CVE-2026-26981: academysoftwarefoundation openexr Signed to Unsigned Conversion Error

Vulnerability summary

CVE-2026-26981 is a medium (CVSS 6.5) Signed to Unsigned Conversion Error vulnerability in academysoftwarefoundation openexr. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-02-2026
   PublishedVulnerability first disclosed.
2. 24-02-2026
   Last modifiedVulnerability information updated.

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch.

• CWE-195Signed to Unsigned Conversion ErrorThe product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.