Most recent entries from all

certfr-2026-avi-0281 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaq…

certfr-2026-avi-0281

EUVD-2026-270473

fkie_cve-2026-26981

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch.

GHSA-q6vj-wxvf-5m8c — OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

Affected: PyPI: OpenEXR

## Summary

A heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`.

## Affected Version

- OpenEXR **main branch** (commit at time of testing) - `src/lib/OpenEXR/ImfContextInit.cpp`, lines 121–136

## Root Cause

`ImfContextInit.cpp:121-126`:

```cpp int64_t stream_sz = s->size (); // e.g., 21 (actual file size) int64_t nend = nread + (int64_t)sz; // e.g., 17 + 4096 = 4113 if (stream_sz > 0 && nend > stream_sz) { sz = stream_sz - nend; // 21 - 4113 = -4092 (signed) } // ... memcpy (buffer, data, sz); // sz is size_t → wraps to 0xFFFFFFFFFFFFF004 ```

`sz` is of type `size_t` (unsigned), but `stream_sz - nend` yields a negative `int64_t` value. This negative value is implicitly converted to `size_t`, wrapping around to a value close to `2^64`, which is then passed to `memcpy` causing a heap-buffer-overflow.

**Suggested fix:** `sz = stream_sz - nend` → `sz = stream_sz - nread`

## Reproduce

Build OpenEXR as static libraries with ASAN enabled, then compile the PoC below.

**PoC Code:**

```cpp #include <cstdint> #include <cstring> #include <iostream>

#include <ImfMultiPartInputFile.h> #include <ImfInputPart.h> #include <ImfHeader.h>

OPENEXR_IMF_INTERNAL_NA…

openSUSE-SU-2026:10272-1 — libIex-3_4-33-3.4.5-1.1 on GA media

libIex-3_4-33-3.4.5-1.1 on GA media

PYSEC-2026-2849 — OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

Affected: PyPI: openexr