AIKIDO-2026-10816
OpenEXR is vulnerable to Integer Overflow
75
High Risk
This Affects:
OpenEXRTL;DR
Affected versions of openexr contain an integer overflow vulnerability in readVariableLengthInteger() when parsing variable-length integers from untrusted EXR files. A specially crafted file can trigger undefined behavior through an oversized bit shift, potentially leading to out-of-bounds reads, memory corruption, or denial of service during file parsing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
OpenEXR is vulnerable to Integer Overflow in versions 3.0.0 - 3.2.8, 3.3.0 - 3.3.10 and 3.4.0 - 3.4.10.
How to fix this
Upgrade the OpenEXR library to a patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant