CWE-190: Integer Overflow or Wraparound in AcademySoftwareFoundation openexr (CVE-2026-41142)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
AI Analysis
Technical Summary
Two vulnerabilities in OpenEXR affect Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products. CVE-2026-41142 is an integer overflow in image resizing that allows arbitrary code execution. CVE-2026-42216 allows information disclosure and denial of service via malformed EXR files. Red Hat has issued an Important security advisory RHSA-2026:38499 providing updated openexr packages (version 3.1.10-8.el10_2.3) that fix these issues. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. The vendor advisory references bugzilla entries BZ-2467623 and BZ-2467633 for the respective CVEs. No CVSS scores are provided in the advisory. The vulnerabilities are related to integer overflow (CWE-190) and improper input validation (CWE-130).
Potential Impact
Successful exploitation of CVE-2026-41142 could allow an attacker to execute arbitrary code on affected systems via crafted image resizing operations. CVE-2026-42216 could lead to information disclosure and denial of service when processing malformed EXR files. These vulnerabilities affect the security and stability of systems processing OpenEXR images, potentially compromising confidentiality, integrity, and availability.
Mitigation Recommendations
Red Hat has released updated openexr packages (version 3.1.10-8.el10_2.3) that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:38499. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.
CWE-190: Integer Overflow or Wraparound in AcademySoftwareFoundation openexr (CVE-2026-41142)
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
CVSS v3.1
Score 8.8high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Two vulnerabilities in OpenEXR affect Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products. CVE-2026-41142 is an integer overflow in image resizing that allows arbitrary code execution. CVE-2026-42216 allows information disclosure and denial of service via malformed EXR files. Red Hat has issued an Important security advisory RHSA-2026:38499 providing updated openexr packages (version 3.1.10-8.el10_2.3) that fix these issues. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. The vendor advisory references bugzilla entries BZ-2467623 and BZ-2467633 for the respective CVEs. No CVSS scores are provided in the advisory. The vulnerabilities are related to integer overflow (CWE-190) and improper input validation (CWE-130).
Potential Impact
Successful exploitation of CVE-2026-41142 could allow an attacker to execute arbitrary code on affected systems via crafted image resizing operations. CVE-2026-42216 could lead to information disclosure and denial of service when processing malformed EXR files. These vulnerabilities affect the security and stability of systems processing OpenEXR images, potentially compromising confidentiality, integrity, and availability.
Mitigation Recommendations
Red Hat has released updated openexr packages (version 3.1.10-8.el10_2.3) that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:38499. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- SUSE Product Security Team
- Advisory Id
- SUSE-SU-2026:2114-1
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a1ca16ae29bf47b505e4532
Added to database: 05/31/2026, 21:00:26 UTC
Last enriched: 07/13/2026, 10:19:10 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 330
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.