CVE-2026-42216

A flaw was found in OpenEXR. A remote attacker could exploit a vulnerability in the IDManifest::init() function when processing specially crafted EXR files. The function attempts to reconstruct strings from a prefix-compressed representation. If a previous string exceeds 255 bytes, the subsequent string is expected to have a 2-byte prefix length. However, the code reads these bytes without validating that the current string has at least two bytes, which could lead to information disclosure or a denial of service (DoS).

This is an Important flaw in OpenEXR that could lead to information disclosure or denial of service. The vulnerability occurs when processing specially crafted EXR files, where an attacker could trigger an out-of-bounds read due to improper validation of string lengths during prefix-compressed string reconstruction. This could impact systems that process untrusted EXR image data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing untrusted or unverified EXR image files. Users should exercise caution when opening EXR files from unknown or suspicious sources, as this vulnerability requires user interaction with a malicious file.