CVE-2026-40250

A flaw was found in OpenEXR, a library for the EXR image file format. An integer overflow vulnerability exists in the internal_dwa_compressor.h component during the calculation of image channel dimensions. This issue, caused by insufficient handling of int32 arithmetic, could allow a local attacker to cause memory corruption by enticing a user to open a specially crafted EXR file. This may lead to a denial of service or potentially more severe impacts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid opening or processing untrusted EXR image files. If processing EXR files is necessary, ensure they originate from trusted sources. This operational control reduces the risk of a local attacker exploiting the integer overflow vulnerability.