CVE-2026-26981

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26981", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T01:41:24.605Z", "datePublished": "2026-02-24T02:26:16.659Z", "dateUpdated": "2026-02-24T20:03:54.667Z"}, "containers": {"cna": {"title": "OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp", "problemTypes": [{"descriptions": [{"cweId": "CWE-195", "lang": "en", "description": "CWE-195: Signed to Unsigned Conversion Error", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c"}, {"name": "https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef", "tags": ["x_refsource_MISC"], "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef"}, {"name": "https://github.com/AcademySoftwareFoundation/openexr/commit/d2be382758adc3e9ab83a3de35138ec28d93ebd8", "tags": ["x_refsource_MISC"], "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/d2be382758adc3e9ab83a3de35138ec28d93ebd8"}], "affected": [{"vendor": "AcademySoftwareFoundation", "product": "openexr", "versions": [{"version": ">= 3.3.0, < 3.3.7", "status": "affected"}, {"version": ">= 3.4.0, < 3.4.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T02:26:16.659Z"}, "descriptions": [{"lang": "en", "value": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch."}], "source": {"advisory": "GHSA-q6vj-wxvf-5m8c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T19:50:34.463990Z", "id": "CVE-2026-26981", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T20:03:54.667Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26981", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T19:50:34.463990Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T20:03:49.168Z"}}], "cna": {"title": "OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp", "source": {"advisory": "GHSA-q6vj-wxvf-5m8c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "AcademySoftwareFoundation", "product": "openexr", "versions": [{"status": "affected", "version": ">= 3.3.0, < 3.3.7"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.5"}]}], "references": [{"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c", "name": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef", "name": "https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/AcademySoftwareFoundation/openexr/commit/d2be382758adc3e9ab83a3de35138ec28d93ebd8", "name": "https://github.com/AcademySoftwareFoundation/openexr/commit/d2be382758adc3e9ab83a3de35138ec28d93ebd8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-195", "description": "CWE-195: Signed to Unsigned Conversion Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T02:26:16.659Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26981", "state": "PUBLISHED", "dateUpdated": "2026-02-24T20:03:54.667Z", "dateReserved": "2026-02-17T01:41:24.605Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T02:26:16.659Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openexr", "vendor": "AcademySoftwareFoundation", "versions": [{"status": "affected", "version": ">= 3.3.0, < 3.3.7"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*", "matchCriteriaId": "9609FA05-1955-406E-BF47-2DB544450059", "versionEndExcluding": "3.3.7", "versionStartIncluding": "3.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD82B1F5-5B57-49E4-A50C-303F66BB55C0", "versionEndExcluding": "3.4.5", "versionStartIncluding": "3.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch."}, {"lang": "es", "value": "OpenEXR proporciona la especificaci\u00f3n y la implementaci\u00f3n de referencia del formato de archivo EXR, un formato de almacenamiento de im\u00e1genes para la industria cinematogr\u00e1fica. En las versiones 3.3.0 a 3.3.6 y 3.4.0 a 3.4.4, ocurre un desbordamiento de b\u00fafer de pila (lectura fuera de l\u00edmites) en la funci\u00f3n `istream_nonparallel_read` en `ImfContextInit.cpp` al analizar un archivo EXR malformado a trav\u00e9s de un `IStream` mapeado en memoria. Una resta de enteros con signo produce un valor negativo que se convierte impl\u00edcitamente a `size_t`, lo que resulta en una longitud masiva que se pasa a `memcpy`. Las versiones 3.3.7 y 3.4.5 contienen un parche."}], "id": "CVE-2026-26981", "lastModified": "2026-06-17T10:26:28.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26981", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T19:50:34.463990Z", "version": "2.0.3"}}]}, "published": "2026-02-24T03:16:01.890", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/d2be382758adc3e9ab83a3de35138ec28d93ebd8"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-195"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "openexr: OpenEXR: Denial of Service via heap-buffer-overflow when parsing a malformed EXR file", "id": "2442135", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442135"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["A flaw was found in OpenEXR. A remote attacker could exploit a heap-buffer-overflow vulnerability in the `istream_nonparallel_read` function by tricking a user into opening a specially crafted EXR file. This occurs when a signed integer subtraction results in a negative value that is then converted to a large unsigned size, leading to an out-of-bounds read during a memory copy operation. Successful exploitation of this vulnerability could lead to a denial of service."], "mitigation": {"lang": "en:us", "value": "No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability."}, "name": "CVE-2026-26981", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "openexr", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "OpenEXR", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "OpenEXR", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "OpenEXR", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "openexr", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-24T02:26:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-26981\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-26981\nhttps://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef\nhttps://github.com/AcademySoftwareFoundation/openexr/commit/d2be382758adc3e9ab83a3de35138ec28d93ebd8\nhttps://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c"], "statement": "```\nThe vulnerable code was introduced in OpenEXR 3.3.0 via commit https://github.com/AcademySoftwareFoundation/openexr/commit/c3e212e9c76c4d174f5624564f9103dc49ca1fd8.\nOpenEXR 1.x (shipped in RHEL 6 and RHEL 7) and OpenEXR 2.x (shipped in RHEL 8) do not include the affected context implementation and are therefore not impacted. RHEL 9, RHEL 10 and RHIVOS-2 ship OpenEXR 3.1.x versions, which predate the introduction of the vulnerable code path and are also not affected.\n```\n```\nAditionally, Starting with OpenEXR 3.x, IlmBase was split out into a separate project named Imath. Imath provides math and numerical types, while OpenEXR contains all EXR file parsing logic.\nThis vulnerability exists within OpenEXR\u2019s file parsing logic and does not affect the separate IlmBase or Imath libraries, which contain only mathematical and utility components and no file decoding functionality\n```", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.3.0,3.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "openexr", "source": "cna", "vendor": "AcademySoftwareFoundation"}, "product": "openexr", "vendor": "academysoftwarefoundation"}], "analysis": {"en": {"generated_at": "2026-04-17T15:54:37.639708+00:00", "value": {"mitigation_remediation": ["Upgrade to OpenEXR 3.3.7 or 3.4.5 or later to apply the official patch", "If an upgrade cannot be performed immediately, avoid using memory\u2011mapped IStream when parsing EXR files from untrusted sources or validate the file size before passing it to the library", "Run the image processing code in a sandboxed or restricted environment to limit the damage if an out\u2011of\u2011bounds read occurs"], "summary": {"action": "Patch Immediately", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The flaw affects the open source OpenEXR library maintained by the AcademySoftwareFoundation. Vulnerable releases include versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4. These versions can be found in the official distribution under the package name openexr. Subsequent releases, 3.3.7 and 3.4.5 and later, contain the patch.", "description_and_impact": "The vulnerability is a heap buffer overflow that occurs during parsing of malformed EXR files when the OpenEXR library uses a memory\u2011mapped IStream. A signed integer subtraction yields a negative result that is implicitly cast to an unsigned `size_t`, causing the\u202f`memcpy` call to read an excessively large amount of data and expose memory contents beyond the intended buffer. This out\u2011of\u2011bounds read can leak sensitive information and, if combined with other weaknesses, may lead to denial of service or more severe exploitation. The CVSS score of 6.5 indicates a moderate impact on confidentiality and potentially disrupts service.", "risk_and_exploitability": "The CVSS base score of 6.5 represents moderate severity, and the EPSS probability of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog, indicating no known public exploits. Based on the description, the most likely attack scenario is local exploitation by providing a crafted EXR file to an application that uses the library through a memory\u2011mapped IStream. If such an application accepts network\u2011supplied files, a remote attacker could potentially trigger the overflow, leading to information disclosure, denial of service, or a broader compromise if additional flaws exist. No additional context is given about the need for elevation or privileged execution, so the impact is confined to the execution context of the affected program."}}}}, "created": "2026-02-24T09:53:22.477808+00:00", "updated": "2026-04-17T16:00:11.380530+00:00", "vendors": ["academysoftwarefoundation", "academysoftwarefoundation$PRODUCT$openexr"]}