CVE-2026-41142: AcademySoftwareFoundation OpenEXR heap OOB write in ImageChannel::resize

CVE-2026-41142 · Severity: high · CVSS 8.8 · Published 2026-05-07

OpenEXR is a widely used professional image format for high-quality visual effects and motion pictures. A flaw in how the library handles image resizing could allow a specially crafted image file to crash an application or potentially allow an attacker to execute unauthorized code. This affects software that processes these images, such as video editors, 3D rendering tools, and thumbnail generators, potentially leading to data theft or system compromise if a user opens a malicious file.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2026-41142 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41142 being exploited in the wild.
How severe is CVE-2026-41142?
High severity, with a CVSS score of 8.8, published 7 May 2026.
Which products and versions are affected?
AcademySoftwareFoundation openexr >= 3.0.0, < 3.2.9; AcademySoftwareFoundation openexr >= 3.3.0, < 3.3.11; AcademySoftwareFoundation openexr >= 3.4.0, < 3.4.11; Red Hat Red Hat Enterprise Linux 9; and 1 more.
Is there a fix for CVE-2026-41142?
A patch was published on 2026-04-22: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41142 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41142?
Check whether you run Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow exists in Imf::ImageChannel::resize() within src/lib/OpenEXRUtil/ImfImageChannel.cpp. The vulnerability occurs when calculating the total number of pixels (_numPixels) by multiplying _pixelsPerRow and _pixelsPerColumn using signed 32-bit integer arithmetic before widening to size_t. If the product exceeds INT_MAX, the resulting value wraps, leading to an undersized heap allocation in TypedFlatImageChannel or TypedDeepImageChannel. Subsequent write operations use the original, un-truncated dimensions as a stride, resulting in a heap-based out-of-bounds (OOB) write. Attackers can exploit this via the public API or by providing a malicious EXR file to applications using the OpenEXRUtil abstraction. The issue is patched in versions 3.2.9, 3.3.11, and 3.4.11.

Affected products

  • AcademySoftwareFoundation openexr >= 3.0.0, < 3.2.9
  • AcademySoftwareFoundation openexr >= 3.3.0, < 3.3.11
  • AcademySoftwareFoundation openexr >= 3.4.0, < 3.4.11
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 10

Timeline

  • 2026-04-17: disclosed: Initial report/PR submitted to GitHub
  • 2026-04-22: patched: Fix merged into main branch
  • 2026-05-05: advisory: GitHub Security Advisory published
  • 2026-05-07: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.