OpenEXR CVE-2026-41142 Integer Overflow in ImageChannel::resize Leading to Heap OOB Write

Vulnerability Overview Vulnerability Name: Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API Vulnerability Description: An integer overflow occurs in the method at when calculating . This multiplication is performed on signed integers. Before widening to , if the dimensions exceed , the multiplication overflows (undefined behavior; in practice, it wraps modulo 2^32). The truncated value is used to allocate a new at , resulting in an undersized allocation. Subsequent pixel writes use the untruncated as the stride via the helper, leading to a controlled heap buffer overflow write. Affected Versions Affected Versions: - 3.0.0-3.0.5 - 3.1.0-3.1.13 - 3.2.0-3.2.8 - 3.3.0-3.3.10 - 3.4.0-3.4.10 Fixed Versions: - 3.2.9 - 3.3.11 - 3.4.11 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High Weakness: - CWE-190 CVE ID: - CVE-2026-41142 Remediation Fixed Files: - (Multiplication site - root cause) - (Primary allocation site) - (Sibling allocation site) Fix Code: Secondary Hardening (Optional): - Assign a non-zero default value to in — the historical default was 0, and while downstream configurations might set this, evidence suggests many consumers do not. POC Code Build and Run Commands Sanitizer Output Impact Original: Heap buffer overflow write with attacker-controlled stride ( ) and attacker-controlled row count ( ). Controlled Content: In the path, the written data consists of pixels provided by the attacker from the file — linearly overwriting content in the heap shape with full control. Heap Shape Primitive: The overflow product is chosen by the attacker. The allocation can be arbitrarily large (several pixels), while remains arbitrarily large — allowing precise control over which heap regions are overwritten. No OOM Signal: The allocation is smaller than the overflow but not larger, providing no or RSS spike signals to the attacker. Radiation: Any application importing untrusted EXR files via OpenEXRUtil without explicitly setting — DCC plugins (Nuke, Blender, DaVinci Resolve), thumbnails, render farm preprocessors, and CI pipelines running exrcheck on user uploads. Context Following recent batches of integer overflow advisories in OpenEXR (GHSA-c74v-6jmd-4963 CompositeDeepScanLine, CVE-2026-39886, CVE-2026-40244/40250 DWA), this surface exists in the OpenEXRUtil base class rather than in the compressor/decompressor — a different code path, which I believe is not covered by any existing or pending advisories. If this overlaps with private advisories, please let me know, and I will withdraw it. Credit Alex Kolchin, Serebrium Security (GitHub: @Medoedus)

Goal Reached Thanks to every supporter — we hit 100%!

OpenEXR CVE-2026-41142 Integer Overflow in ImageChannel::resize Leading to Heap OOB Write

More from this source