CVE-2026-42216: academysoftwarefoundation openexr Out-of-bounds Read

Vulnerability summary

CVE-2026-42216 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in academysoftwarefoundation openexr. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-05-2026
   PublishedVulnerability first disclosed.
2. 09-09-2026
   Last modifiedVulnerability information updated.

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.