crítica
CVE-2026-42216
OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Julia8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Julia (alta), Oracle (alta), Rocky Linux (alta).
Descripción
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | openexr, openexr-devel, openexr-libs | 3.1.10-8.el10_2.3 |
| alma 9 | openexr, openexr-devel, openexr-libs | 3.1.1-3.el9_8.3 |
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.13-r0 |
| alpine 3.24 | openexr | 3.4.11-r0 |
| alpine edge | openexr | 3.4.11-r0 |
| amazon linux 2023 | openexr, openexr-debuginfo, openexr-debugsource y 3 más | 3.1.5-1.amzn2023.0.11 |
| chainguard | openexr | 3.4.11-r0 |
| debian 11 | openexr | sin corrección indicada |
| debian 12 | openexr | sin corrección indicada |
| debian 13 | openexr | sin corrección indicada |
| debian 14 | openexr | 3.4.14-0.1 |
Mostrar las 56 entradas de 30 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | openexr | 3.1.10-8.el10_2.3 |
| alma 10 | openexr-devel | 3.1.10-8.el10_2.3 |
| alma 10 | openexr-libs | 3.1.10-8.el10_2.3 |
| alma 9 | openexr | 3.1.1-3.el9_8.3 |
| alma 9 | openexr-devel | 3.1.1-3.el9_8.3 |
| alma 9 | openexr-libs | 3.1.1-3.el9_8.3 |
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.13-r0 |
| alpine 3.24 | openexr | 3.4.11-r0 |
| alpine edge | openexr | 3.4.11-r0 |
| amazon linux 2023 | openexr | 3.1.5-1.amzn2023.0.11 |
| amazon linux 2023 | openexr-debuginfo | 3.1.5-1.amzn2023.0.11 |
| amazon linux 2023 | openexr-debugsource | 3.1.5-1.amzn2023.0.11 |
| amazon linux 2023 | openexr-devel | 3.1.5-1.amzn2023.0.11 |
| amazon linux 2023 | openexr-libs | 3.1.5-1.amzn2023.0.11 |
| amazon linux 2023 | openexr-libs-debuginfo | 3.1.5-1.amzn2023.0.11 |
| chainguard | openexr | 3.4.11-r0 |
| debian 11 | openexr | sin corrección indicada |
| debian 12 | openexr | sin corrección indicada |
| debian 13 | openexr | sin corrección indicada |
| debian 14 | openexr | 3.4.14-0.1 |
| echo | openexr | 3.1.13-2+e1 |
| julia::Julia Ecosystem Security Advisories | OpenEXR_jll | 3.4.12+0 |
| Oracle Linux 9 | openexr | 3.1.1-3.el9_8.3 |
| Oracle Linux 9 | openexr-devel | 3.1.1-3.el9_8.3 |
| Oracle Linux 9 | openexr-libs | 3.1.1-3.el9_8.3 |
| rapidfort alma 10 | openexr | 3.1.10-8.el10_2.3 |
| rapidfort alma 10 | openexr-devel | 3.1.10-8.el10_2.3 |
| rapidfort alma 10 | openexr-libs | 3.1.10-8.el10_2.3 |
| rapidfort alma 9 | openexr | 3.1.1-3.el9_8.3 |
| rapidfort alma 9 | openexr-libs | 3.1.1-3.el9_8.3 |
| rapidfort amazon linux 2023 | openexr | 3.1.5-1.amzn2023.0.11 |
| rapidfort amazon linux 2023 | openexr-devel | 3.1.5-1.amzn2023.0.11 |
| rapidfort amazon linux 2023 | openexr-libs | 3.1.5-1.amzn2023.0.11 |
| rapidfort debian 12 | openexr | 0:3.4.14-0.1 |
| rapidfort debian 12 | rf-openexr | 0:3.4.14-0.1 |
| rapidfort debian 13 | openexr | 0:3.4.14-0.1 |
| rapidfort debian 13 | rf-openexr | 0:3.4.14-0.1 |
| rapidfort Oracle Linux 10 | openexr | 0:3.1.10-8.el10_2.3 |
| rapidfort Oracle Linux 10 | openexr-libs | 0:3.1.10-8.el10_2.3 |
| rapidfort Oracle Linux 9 | openexr | 0:3.1.1-3.el9_8.3 |
| rapidfort Oracle Linux 9 | openexr-libs | 0:3.1.1-3.el9_8.3 |
| rapidfort rocky 9 | openexr | 0:3.1.1-3.el9_8.3 |
| rapidfort rocky 9 | openexr-libs | 0:3.1.1-3.el9_8.3 |
| Red Hat | OpenEXR | sin corrección indicada |
| Red Hat | OpenEXR-devel | sin corrección indicada |
| Red Hat | OpenEXR-libs | sin corrección indicada |
| rocky 10 | openexr | 0.0.0 |
| rocky 10 | openexr-libs | 0.0.0 |
| rocky 9 | openexr | 3.1.1-3.el9_8.3 |
| rocky 9 | openexr-libs | 3.1.1-3.el9_8.3 |
| root.io debian 11 | rootio-openexr | sin corrección indicada |
| root.io debian 12 | openexr | 3.1.5-5.root.io.21 |
| root.io debian 12 | rootio-openexr | 3.1.5-5.root.io.21 |
| root.io debian 13 | rootio-openexr | sin corrección indicada |
| wolfi | openexr | 3.4.11-r0 |
Referencias
- https://access.redhat.com/errata/RHSA-2026:38498
- https://access.redhat.com/errata/RHSA-2026:38499
- https://access.redhat.com/errata/RHSA-2026:39024
- https://access.redhat.com/errata/RHSA-2026:39025
- https://access.redhat.com/errata/RHSA-2026:39026
- https://access.redhat.com/errata/RHSA-2026:39027
- https://access.redhat.com/security/cve/CVE-2026-42216
- https://bugzilla.redhat.com/2467623
Las 22 referencias
- https://bugzilla.redhat.com/2467633
- https://bugzilla.redhat.com/show_bug.cgi?id=2467623
- https://bugzilla.redhat.com/show_bug.cgi?id=2467633
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41142
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42216
- https://errata.almalinux.org/9/ALSA-2026-38498.html
- https://errata.rockylinux.org/RLSA-2026:38498
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-65j8-95g9-jgj4
- https://linux.oracle.com/cve/CVE-2026-42216.html
- https://linux.oracle.com/errata/ELSA-2026-38499.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-42216
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42216.json
- https://www.cve.org/CVERecord?id=CVE-2026-42216