CVE-2026-42217

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.0.0 through 3.2.8 OpenEXR versions 3.3.0 through 3.3.10 OpenEXR versions 3.4.0 through 3.4.10

Description The readVariableLengthInteger() function decodes a variable-length integer from untrusted EXR input without bounding the shift count. When a sufficient number of continuation bytes are processed, the code performs a left shift by 70 on a 64-bit value, resulting in undefined behavior.

Recommendations Update versions 3.0.0 through 3.2.8 to version 3.2.9. Update versions 3.3.0 through 3.3.10 to version 3.3.11. Update versions 3.4.0 through 3.4.10 to version 3.4.11.