The vulnerability exists in the GEGL Radiance HDR loader component where it reads past the end of a memory-mapped image if an uncompressed scanline is shorter than the declared width in the file header. This out-of-bounds read can cause the application using the loader to crash upon opening a specially crafted HDR file. The issue affects Red Hat Enterprise Linux 10. The CVSS v3.1 base score is 5.5, indicating a medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and no confidentiality or integrity impact but high availability impact.

The vulnerability can cause denial of service by crashing applications that use the vulnerable HDR loader when processing maliciously crafted HDR image files. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-103641 for current remediation guidance. Until a patch is applied, avoid opening untrusted Radiance HDR files with affected applications.