CVE-2026-41142 is an integer overflow vulnerability in the AcademySoftwareFoundation's OpenEXR library affecting the ImageChannel::resize function. The flaw exists in versions 3.0.0 up to but not including 3.2.9, 3.3.0 up to but not including 3.3.11, and 3.4.0 up to but not including 3.4.11. This overflow can cause a heap out-of-bounds write when resizing images via the OpenEXRUtil public API, potentially leading to arbitrary code execution. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Red Hat has released security advisories and updated packages for their supported platforms, providing fixes in OpenEXR version 3.1.10-8.el10_0.3 and related builds. Users of affected versions should apply these updates to remediate the issue.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code, cause denial of service, and compromise confidentiality and integrity due to heap out-of-bounds writes triggered by integer overflow during image resizing. The vulnerability affects the OpenEXR library used in high-dynamic-range image processing, which is critical in motion picture and related industries. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability with network attack vector and no privileges required but user interaction needed.

A fix is available. The vulnerability has been patched in OpenEXR versions 3.2.9, 3.3.11, and 3.4.11. Red Hat has issued security advisories and updated packages for Red Hat Enterprise Linux 10.0 Extended Update Support and related distributions. Users should apply the provided security updates from their vendor repositories as detailed in the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-41142 and https://access.redhat.com/errata/RHSA-2026:39024). No additional mitigation steps are required beyond applying these official patches.