Описание
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
A flaw was found in OpenEXR. A remote attacker could exploit a vulnerability in the IDManifest::init() function when processing specially crafted EXR files. The function attempts to reconstruct strings from a prefix-compressed representation. If a previous string exceeds 255 bytes, the subsequent string is expected to have a 2-byte prefix length. However, the code reads these bytes without validating that the current string has at least two bytes, which could lead to information disclosure or a denial of service (DoS).
Отчет
This is an Important flaw in OpenEXR that could lead to information disclosure or denial of service. The vulnerability occurs when processing specially crafted EXR files, where an attacker could trigger an out-of-bounds read due to improper validation of string lengths during prefix-compressed string reconstruction. This could impact systems that process untrusted EXR image data.
Меры по смягчению последствий
To mitigate this issue, avoid processing untrusted or unverified EXR image files. Users should exercise caution when opening EXR files from unknown or suspicious sources, as this vulnerability requires user interaction with a malicious file.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | OpenEXR | Will not fix | ||
| Red Hat Enterprise Linux 7 | OpenEXR | Not affected | ||
| Red Hat Enterprise Linux 8 | OpenEXR | Not affected | ||
| Red Hat Enterprise Linux 10 | openexr | Fixed | RHSA-2026:38499 | 13.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | openexr | Fixed | RHSA-2026:39024 | 13.07.2026 |
| Red Hat Enterprise Linux 9 | openexr | Fixed | RHSA-2026:38498 | 13.07.2026 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | openexr | Fixed | RHSA-2026:39027 | 13.07.2026 |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | openexr | Fixed | RHSA-2026:39026 | 13.07.2026 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | openexr | Fixed | RHSA-2026:39025 | 13.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
OpenEXR provides the specification and reference implementation of the ...
EPSS
8.1 High
CVSS3