VYPR
Get started
← All advisories
Critical severity9.8NVD Advisory· Published May 7, 2026· Updated May 8, 2026

CVE-2026-42217

CVE-2026-42217

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger() decodes a variable-length integer from untrusted EXR input without bounding the shift count. After enough continuation bytes, the code executes a left shift by 70 on a 64-bit value, which is undefined behavior. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

Affected products

1
  • Openexr/Openexr
    cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*
    Range: >=3.0.0,<3.2.9

Patches

1
21eaa33bcbbb

Harden IDManifest parsing against illegal shift and string prefix OOB (#2378)

https://github.com/AcademySoftwareFoundation/openexrCary PhillipsApr 22, 2026via nvd-ref
commitPR #2378
1 file changed · +7 −0
  • src/lib/OpenEXR/ImfIDManifest.cpp+7 −0 modified
    @@ -115,6 +115,13 @@ readVariableLengthInteger (const char*& readPtr, const char* endPtr)
             throw IEX_NAMESPACE::InputExc (
                 "IDManifest too small for variable length integer");
         }
+        // Each chunk contributes at most 7 bits; shifts must stay < 64 or
+        // (byte & 127) << shift has undefined behavior (C++).
+        if (shift >= 64)
+        {
+            throw IEX_NAMESPACE::InputExc (
+                "Invalid variable-length integer in IDManifest");
+        }
         byte = *(unsigned char*) readPtr++;
         // top bit of byte isn't part of actual number, it just indicates there's more info to come
         // so take bottom 7 bits, shift them to the right place, and insert them

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.