CVE-2026-42216 is an out-of-bounds read in OpenEXR, scored CVSS 9.1 (critical) in the record. The IDManifest parser reads two bytes of a string without checking it has them. Upgrade OpenEXR to 3.2.9, 3.3.11 or 3.4.11, and rebuild anything that bundles it.
What's affected
The OpenEXR advisory lists these affected ranges: 3.0.0 to 3.0.5, 3.1.0 to 3.1.13, 3.2.0 to 3.2.8, 3.3.0 to 3.3.10 and 3.4.0 to 3.4.10. The patched versions are 3.2.9, 3.3.11 and 3.4.11. The 3.0 and 3.1 lines have no fixed release listed, so move to 3.2.9 or later.
The weak code is IDManifest::init(), which rebuilds strings from a prefix compressed form. A crafted EXR file can reach it.
How to check if you're exposed
- Find the OpenEXR version on the system.
pkg-config --modversion OpenEXR
dpkg -l | grep -i openexr
rpm -qa | grep -i openexr
ldconfig -p | grep -i openexr
- Remember that many programs bundle their own copy. Check image tools, renderers, Python wheels and container images, not only system packages.
- Compare each version with the ranges above.
What to do now
- Upgrade OpenEXR to 3.2.9, 3.3.11 or 3.4.11 or later, whichever matches your line, and rebuild anything that links it statically.
- Rebuild or update container images that include OpenEXR, then redeploy.
- Until then, avoid opening EXR files from untrusted sources in services that run without isolation.
- Run image processing in a sandbox with limited memory and no network, so a crash or leak has little to reach.
Why it matters
The classes are CWE-125, out-of-bounds read, and CWE-130, improper handling of length parameter inconsistency. When a long string is followed by an empty one, the code assumes a two byte length prefix is there and reads it anyway, one byte past the end of a heap buffer.
The advisory says debug builds catch it, but optimized production builds do not. It describes a possible heap memory leak and a crash that makes opening a malicious file a denial of service. Programs that process EXR files from users or from the web are the main concern. The KEV flag is false, and I found no report of exploitation in the wild.
Quick check
Is CVE-2026-42216 exploited in the wild?
The KEV flag is false and the advisory does not say so. The advisory does include a reproduction setting, so do not delay the update.
Sources
Last reviewed: 19 October 2026.
