OpenEXR CVE-2026-42217

The EXR file must be opened by an application or library using a vulnerable OpenEXR version (3.0.0-3.2.8, 3.3.0-3.3.10, 3.4.0-3.4.10). The IDManifest attribute in the file must contain a maliciously crafted variable-length integer with continuation bytes exceeding 9 bytes, causing the shift count to exceed 64. No special build flags, non-default configurations, or privilege escalation are required; any application processing untrusted EXR files is vulnerable. The vulnerability is NOT limited to reading the entire file-parsing may fail or trigger undefined behavior before the full image is decoded, depending on where the IDManifest attribute appears in the file structure. User interaction (opening a file) is required in typical workflows, but automated batch-processing pipelines eliminate even this barrier.

CVSS 6.3 with AV:N/AC:L/AT:P (remotely exploitable, low complexity, partial attack requirements-specifically crafted EXR files) aligns with realistic risk. The integrity and confidentiality impact are both marked as low (VI:N, VC:L), suggesting limited immediate damage from a single exploitation; however, undefined behavior in C++ is inherently unpredictable and can escalate depending on compiler flags and memory layout. The AT:P modifier (partial) likely reflects the need to craft a valid EXR file structure with the malicious variable-length integer, raising attack complexity slightly above trivial. No public exploit code has been identified; however, the attack surface is broad-any software parsing untrusted EXR files (graphics engines, VFX tools, image processors, web servers with EXR plugins) is at risk. The attack is not automatable at scale without reverse-engineering EXR parsers in victim applications, but the technical barrier is low for motivated attackers. Patch availability (3.2.9, 3.3.11, 3.4.11) reduces risk for maintainers of dependent projects; however, lag in upgrades across enterprise VFX pipelines is common. Real-world risk is moderate to high in media and entertainment sectors where EXR is standard; low in general-purpose software ecosystems.

An attacker crafts a malicious EXR file containing an IDManifest attribute with a variable-length integer encoded using more than nine continuation bytes, triggering a left-shift operation by 70 or more bits on a 64-bit value. A VFX artist or automated pipeline process opens the file using a vulnerable OpenEXR library or application. Undefined behavior at runtime may cause a segmentation fault (denial of service), corrupt the heap or stack (potential code execution or information leakage), or expose adjacent memory depending on compiler flags and the execution environment.