The vulnerability CVE-2026-42216 in AcademySoftwareFoundation's OpenEXR affects versions 3.0.0 through before 3.2.9, 3.3.0 through before 3.3.11, and 3.4.0 through before 3.4.11. It is an out-of-bounds read (CWE-125) in the IDManifest::init() function, which reconstructs strings from a prefix-compressed format. When the previous string exceeds 255 bytes, the next string is expected to start with a 2-byte prefix length. However, the code reads the first two bytes of the current string without verifying that it contains at least two bytes, leading to an out-of-bounds read. This flaw can cause information disclosure and denial of service. The issue has been fixed in versions 3.2.9, 3.3.11, and 3.4.11. Red Hat has released security advisories and patches for their affected OpenEXR packages, including Red Hat Enterprise Linux 10.0 Extended Update Support.

Successful exploitation of this vulnerability can lead to information disclosure and denial of service conditions when processing malformed EXR files. The CVSS 4.0 base score is 8.8 (high severity), indicating a significant impact with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and availability. There are no known exploits in the wild at this time.

A fix is available in OpenEXR versions 3.2.9, 3.3.11, and 3.4.11. Users and administrators should upgrade to these or later patched versions to remediate the vulnerability. Red Hat has issued security advisories and updates for their supported distributions, including Red Hat Enterprise Linux 10.0 Extended Update Support. Applying these vendor-provided updates will mitigate the issue. Patch status is confirmed by the vendor advisory. No additional mitigation actions are specified.