How severe is CVE-2026-26981?

CVE-2026-26981 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-26981 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-26981?

CVE-2026-26981 affects Openexr. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-26981?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-26981 have an EU (EUVD) identifier?

Yes. CVE-2026-26981 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-7407.

When was CVE-2026-26981 published?

CVE-2026-26981 was published on 2026-02-24 and last updated on 2026-06-17.

CVE-2026-26981

CVE-2026-26981 is a medium-severity vulnerability in Openexr with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-195.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 1% (41st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-7407
Weakness: CWE-195
Affected product: Openexr
Published: 2026-02-24
Last modified: 2026-06-17

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch.

Frequently asked questions

What is CVE-2026-26981?: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4, a heap-buffer-overflow (OOB read) occurs in the `istream_nonparallel_read` function in `ImfContextInit.cpp` when parsing a malformed EXR file through a memory-mapped `IStream`. A signed integer subtraction produces a negative value that is implicitly converted to `size_t`, resulting in a massive length being passed to `memcpy`. Versions 3.3.7 and 3.4.5 contain a patch.
How severe is CVE-2026-26981?: CVE-2026-26981 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-26981 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-26981?: CVE-2026-26981 affects Openexr. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-26981?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-26981 have an EU (EUVD) identifier?: Yes. CVE-2026-26981 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-7407.
When was CVE-2026-26981 published?: CVE-2026-26981 was published on 2026-02-24 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*

More vulnerabilities in Openexr

CVE-2026-42217 — Critical (CVSS 9.8): OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the…
CVE-2026-42216 — Critical (CVSS 9.1): OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the…
CVE-2025-48072 — Critical (CVSS 9.1): OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the…
CVE-2023-5841 — Critical (CVSS 9.1): Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy…
CVE-2026-41142 — High (CVSS 8.8): OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the…
CVE-2021-23169 — High (CVSS 8.8): A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker…

All CVEs affecting Openexr →

Other CWE-195 vulnerabilities

CVE-2024-25388 — High (CVSS 8.4): drivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.
CVE-2020-6096 — High (CVSS 8.1): An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000.…
CVE-2025-65495 — High (CVSS 7.5): Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers…
CVE-2026-41682 — Medium (CVSS 6.9): pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is…
CVE-2025-30646 — Medium (CVSS 6.5): A Signed to Unsigned Conversion Error vulnerability in the Layer 2 Control Protocol daemon (l2cpd) of Juniper Networks…
CVE-2025-67897 — Medium (CVSS 5.3): In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take…

Browse all CWE-195 vulnerabilities →