CVE-2026-42217 is an integer overflow in OpenEXR, scored CVSS 9.8 (critical) in the record. Decoding a variable-length integer from an EXR file does not bound the shift count. Upgrade OpenEXR to 3.2.9, 3.3.11 or 3.4.11, and rebuild anything that bundles it.
What's affected
The OpenEXR advisory lists these affected ranges: 3.0.0 to 3.0.5, 3.1.0 to 3.1.13, 3.2.0 to 3.2.8, 3.3.0 to 3.3.10 and 3.4.0 to 3.4.10. The patched versions are 3.2.9, 3.3.11 and 3.4.11. The 3.0 and 3.1 lines have no fixed release listed, so move to 3.2.9 or later.
The weak code is readVariableLengthInteger(), which is used when reading the idmanifest attribute of an EXR file.
How to check if you're exposed
- Find the OpenEXR version on the system.
pkg-config --modversion OpenEXR
dpkg -l | grep -i openexr
rpm -qa | grep -i openexr
ldconfig -p | grep -i openexr
- Remember that many programs bundle their own copy. Check image tools, renderers, Python wheels and container images, not only system packages.
- Compare each version with the ranges above.
What to do now
- Upgrade OpenEXR to 3.2.9, 3.3.11 or 3.4.11 or later, whichever matches your line, and rebuild anything that links it statically.
- Rebuild or update container images that include OpenEXR, then redeploy.
- Until then, avoid opening EXR files from untrusted sources in services that run without isolation.
- Run image processing in a sandbox with limited memory and no network, so a crash or leak has little to reach.
Why it matters
The class is CWE-190, integer overflow or wraparound. The decoder adds seven bits per continuation byte, but never stops at 64. After enough bytes it shifts a 64-bit value by 70, which is undefined behavior in the language.
The advisory says the corrupted result is then used as a string count, so the parser may try to read well past the end of the buffer. The outcome depends on the compiler and its optimization level. The NVD score of 9.8 assumes the worst case for a file parser. The KEV flag is false, and I found no report of exploitation in the wild.
Try it yourself
Image scans find libraries like OpenEXR inside container layers, where system package checks miss them.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if I only use OpenEXR in a desktop tool?
The risk is highest for services that open files from untrusted sources. Desktop use is lower risk, but updating is still cheap and the fix is a library bump.
Sources
Last reviewed: 19 October 2026.
