CVE-2026-41142: OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41142?
CVE-2026-41142 is classified as a high-severity vulnerability due to its potential for causing an out-of-bounds write leading to memory corruption.
How do I fix CVE-2026-41142?
To fix CVE-2026-41142, upgrade OpenEXR to version 3.2.9 or later, or 3.3.11 or later, to ensure the vulnerability is mitigated.
What versions of OpenEXR are affected by CVE-2026-41142?
OpenEXR versions from 3.0.0 up to but not including 3.2.9, as well as versions 3.3.0 to 3.3.11 and 3.4.0 to 3.4.11 are affected by CVE-2026-41142.
What type of vulnerability is CVE-2026-41142?
CVE-2026-41142 is characterized as an integer overflow vulnerability that can lead to heap out-of-bounds writes.
Can CVE-2026-41142 be exploited remotely?
Yes, CVE-2026-41142 can be exploited potentially via crafted images processed through the OpenEXR public API.