CVE-2026-26981 — OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

Affected: AcademySoftwareFoundation openexr

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch.

GHSA-q6vj-wxvf-5m8c — OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

Affected: PyPI: OpenEXR

## Summary

A heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`.

## Affected Version

- OpenEXR **main branch** (commit at time of testing) - `src/lib/OpenEXR/ImfContextInit.cpp`, lines 121–136

## Root Cause

`ImfContextInit.cpp:121-126`:

```cpp int64_t stream_sz = s->size (); // e.g., 21 (actual file size) int64_t nend = nread + (int64_t)sz; // e.g., 17 + 4096 = 4113 if (stream_sz > 0 && nend > stream_sz) { sz = stream_sz - nend; // 21 - 4113 = -4092 (signed) } // ... memcpy (buffer, data, sz); // sz is size_t → wraps to 0xFFFFFFFFFFFFF004 ```

`sz` is of type `size_t` (unsigned), but `stream_sz - nend` yields a negative `int64_t` value. This negative value is implicitly converted to `size_t`, wrapping around to a value close to `2^64`, which is then passed to `memcpy` causing a heap-buffer-overflow.

**Suggested fix:** `sz = stream_sz - nend` → `sz = stream_sz - nread`

## Reproduce

Build OpenEXR as static libraries with ASAN enabled, then compile the PoC below.

**PoC Code:**

```cpp #include <cstdint> #include <cstring> #include <iostream>

#include <ImfMultiPartInputFile.h> #include <ImfInputPart.h> #include <ImfHeader.h>

OPENEXR_IMF_INTERNAL_NA…

Most recent entries from all

CVE-2026-26981 — OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

GHSA-q6vj-wxvf-5m8c — OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp