critical
CVE-2026-42217
OpenEXR: OpenEXR: Information disclosure via malformed EXR image file processing
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Julia6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Amazon (high), Red Hat (medium), Julia (medium).
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger() decodes a variable-length integer from untrusted EXR input without bounding the shift count. After enough continuation bytes, the code executes a left shift by 70 on a 64-bit value, which is undefined behavior. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.13-r0 |
| alpine 3.24 | openexr | 3.4.11-r0 |
| alpine edge | openexr | 3.4.11-r0 |
| amazon linux 2023 | openexr, openexr-debuginfo, openexr-debugsource and 3 more | 3.1.5-1.amzn2023.0.11 |
| chainguard | openexr | 3.4.11-r0 |
| debian 11 | openexr | no fix listed |
| debian 12 | openexr | no fix listed |
| debian 13 | openexr | no fix listed |
| debian 14 | openexr | 3.4.14-0.1 |
| echo | openexr | 3.1.13-2+e1 |
| julia::Julia Ecosystem Security Advisories | OpenEXR_jll | 3.4.12+0 |
Show all 71 entries from 35 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.13-r0 |
| alpine 3.24 | openexr | 3.4.11-r0 |
| alpine edge | openexr | 3.4.11-r0 |
| amazon linux 2023 | openexr | 3.1.5-1.amzn2023.0.11 |
| amazon linux 2023 | openexr-debuginfo | 3.1.5-1.amzn2023.0.11 |
| amazon linux 2023 | openexr-debugsource | 3.1.5-1.amzn2023.0.11 |
| amazon linux 2023 | openexr-devel | 3.1.5-1.amzn2023.0.11 |
| amazon linux 2023 | openexr-libs | 3.1.5-1.amzn2023.0.11 |
| amazon linux 2023 | openexr-libs-debuginfo | 3.1.5-1.amzn2023.0.11 |
| chainguard | openexr | 3.4.11-r0 |
| debian 11 | openexr | no fix listed |
| debian 12 | openexr | no fix listed |
| debian 13 | openexr | no fix listed |
| debian 14 | openexr | 3.4.14-0.1 |
| echo | openexr | 3.1.13-2+e1 |
| julia::Julia Ecosystem Security Advisories | OpenEXR_jll | 3.4.12+0 |
| rapidfort alma 10 | openexr | no fix listed |
| rapidfort alma 10 | openexr-devel | no fix listed |
| rapidfort alma 10 | openexr-libs | no fix listed |
| rapidfort alma 9 | openexr | no fix listed |
| rapidfort alma 9 | openexr-devel | no fix listed |
| rapidfort alma 9 | openexr-libs | no fix listed |
| rapidfort alpine 3.20 | openexr | 3.3.2-r0 |
| rapidfort alpine 3.21 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.22 | openexr | 3.3.11-r0 |
| rapidfort amazon linux 2023 | openexr | 3.1.5-1.amzn2023.0.11 |
| rapidfort amazon linux 2023 | openexr-devel | 3.1.5-1.amzn2023.0.11 |
| rapidfort amazon linux 2023 | openexr-libs | 3.1.5-1.amzn2023.0.11 |
| rapidfort debian 12 | openexr | 0:3.4.14-0.1 |
| rapidfort debian 12 | rf-openexr | 0:3.4.14-0.1 |
| rapidfort debian 13 | openexr | 0:3.4.14-0.1 |
| rapidfort debian 13 | rf-openexr | 0:3.4.14-0.1 |
| rapidfort fedora 43 | openexr | 0:3.2.4-7.fc43 |
| rapidfort fedora 43 | openexr-devel | 3.2.4-7.fc43 |
| rapidfort fedora 43 | openexr-libs | 0:3.2.4-7.fc43 |
| rapidfort Oracle Linux 10 | openexr | no fix listed |
| rapidfort Oracle Linux 10 | openexr-devel | no fix listed |
| rapidfort Oracle Linux 10 | openexr-libs | no fix listed |
| rapidfort Oracle Linux 9 | openexr | no fix listed |
| rapidfort Oracle Linux 9 | openexr-devel | no fix listed |
| rapidfort Oracle Linux 9 | openexr-libs | no fix listed |
| rapidfort Red Hat 10 | openexr | no fix listed |
| rapidfort Red Hat 10 | openexr-devel | no fix listed |
| rapidfort Red Hat 10 | openexr-libs | no fix listed |
| rapidfort Red Hat 9 | openexr | no fix listed |
| rapidfort Red Hat 9 | openexr-devel | no fix listed |
| rapidfort Red Hat 9 | openexr-libs | no fix listed |
| rapidfort rocky 10 | openexr | no fix listed |
| rapidfort rocky 10 | openexr-devel | no fix listed |
| rapidfort rocky 10 | openexr-libs | no fix listed |
| rapidfort rocky 9 | openexr | no fix listed |
| rapidfort rocky 9 | openexr-devel | no fix listed |
| rapidfort rocky 9 | openexr-libs | no fix listed |
| rapidfort ubuntu 20.04 | openexr | 0:3.4.6+ds-4 |
| rapidfort ubuntu 20.04 | rf-openexr | 0:3.4.6+ds-4 |
| rapidfort ubuntu 22.04 | openexr | 0:3.4.6+ds-4 |
| rapidfort ubuntu 22.04 | rf-openexr | 0:3.4.6+ds-4 |
| rapidfort ubuntu 24.04 | openexr | 0:3.4.6+ds-4 |
| rapidfort ubuntu 24.04 | rf-openexr | 0:3.4.6+ds-4 |
| Red Hat | OpenEXR | no fix listed |
| Red Hat | OpenEXR-devel | no fix listed |
| Red Hat | OpenEXR-libs | no fix listed |
| Red Hat | openexr | no fix listed |
| Red Hat | openexr-devel | no fix listed |
| Red Hat | openexr-libs | no fix listed |
| root.io debian 11 | rootio-openexr | no fix listed |
| root.io debian 12 | openexr | 3.1.5-5.root.io.21 |
| root.io debian 12 | rootio-openexr | 3.1.5-5.root.io.21 |
| root.io debian 13 | rootio-openexr | no fix listed |
| wolfi | openexr | 3.4.11-r0 |
References
- https://access.redhat.com/security/cve/CVE-2026-42217
- https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c
- https://github.com/AcademySoftwareFoundation/openexr/pull/2378
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m
- https://nvd.nist.gov/vuln/detail/CVE-2026-42217
- https://www.cve.org/CVERecord?id=CVE-2026-42217