CVE-2026-42217

CVEs › CVE-2026-42217

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger() decodes a variable-length integer from untrusted EXR input without bounding the shift count. After enough continuation bytes, the code executes a left shift by 70 on a 64-bit value, which is undefined behavior. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: MEDIUM
CVSS score: 6.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Effective score: 6.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-190
Reserved: 2026-04-25
Published: 2026-05-07 06:04 UTC
Last updated: 2026-05-07 14:08 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42217.json
Linked Threat: CVE-2026-42217 — CVE-2026-42217

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-07 04:16:34 UTC
NVD last modified: 2026-05-08 17:01:46 UTC
NVD CVSS v3.1: 9.8 / 10 CRITICAL source: nvd@nist.gov
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 3.9 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0005 (probability of exploitation in next 30 days)
EPSS percentile: 16.33% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD / KEV / EPSS data refreshed 2026-05-25 09:40 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-28300
Assigner: GitHub_M
Published: May 7, 2026, 4:04:54 AM
Updated: May 7, 2026, 12:08:50 PM
EUVD base score (CVSS 4.0): 6.3 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0500
Vendors: AcademySoftwareFoundation
Products: OpenEXR (3.3.0, < 3.3.11)

OpenEXR (3.0.0, < 3.2.9)

OpenEXR (3.0.0, < 3.2.9)

OpenEXR (3.4.0, < 3.4.11)

OpenEXR (3.4.0, < 3.4.11)

OpenEXR (3.3.0, < 3.3.11)

ENISA description: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger() decodes a variable-length integer from untrusted EXR input without bounding the shift count. After enough continuation bytes, the code executes a left shift by 70 on a 64-bit value, which is undefined behavior. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

EUVD references (3)

Affected products (1)

Vendor	Product	Versions	Platforms
AcademySoftwareFoundation	openexr	`>= 3.0.0, < 3.2.9` (affected), `>= 3.3.0, < 3.3.11` (affected), `>= 3.4.0, < 3.4.11` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m x_refsource_CONFIRM
https://github.com/AcademySoftwareFoundation/openexr/pull/2378 x_refsource_MISC
https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c x_refsource_MISC

MITRE references (3) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c x_refsource_MISC
https://github.com/AcademySoftwareFoundation/openexr/pull/2378 x_refsource_MISC
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m x_refsource_CONFIRM

Web references (6)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://cwe.mitre.org/data/definitions/190.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2026-42217 rapid7:attackerkb.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28300 rapid7:euvd.enisa.europa.eu
https://www.first.org/epss/ tenable:www.first.org
https://nvd.nist.gov/vuln/detail/CVE-2026-42217 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-42217 tenable:www.cve.org

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c security-advisories@github.com Patch
https://github.com/AcademySoftwareFoundation/openexr/pull/2378 security-advisories@github.com Issue TrackingPatch
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m security-advisories@github.com ExploitVendor AdvisoryMitigation

Remediations (17)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

THREAT ADVISORY RedSun Zero-Day (Windows Defender) April 17, 2026

web:blackswan-cybersecurity.com

Cloud Files API activity originating outside legitimate OneDrive/sync processes. Mitigation Steps: Apply all Windows updates immediately (monitor MSRC for an emergency RedSun-specific patch . None released as of April 17, 2026 ). Supplement Defender with a secondary EDR solution (e.g., Huntress) capable of detecting Defender bypasses.

2026-05-23 21:08 UTC
Oracle Critical Patch Update, April 2026 Security Update Review

web:blog.qualys.com

Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 481 security vulnerabilities.

2026-05-23 21:08 UTC
New BitUnlocker Attack Bypasses Windows 11 Disk Encryption in Just 5 ...

web:cyberpress.org

A newly published proof-of-concept tool called BitUnlocker exposes a dangerous downgrade attack that can bypass Microsoft's BitLocker full-disk encryption on fully patched Windows 11 machines, granting complete access to encrypted drives in under five minutes. The attack exploits CVE -2025-48804, a vulnerability in Windows BitLocker that allows an attacker to mix untrusted data with trusted ...

2026-05-23 21:08 UTC
Nvd - Cve-2026-42217

web:nvd.nist.gov

An official website of the United States government Here's how you know

2026-05-23 21:08 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 21:08 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-05-23 21:08 UTC
Database CVE, CWE, CISA KEV & Vulnerability Intelligence | CVE Find

web:www.cvefind.com

CVE Find is a real-time vulnerability database indexing 351 731 security flaws ( CVE ) from MITRE, NVD, CISA KEV, CWE and CAPEC. 1311 new CVEs were published in the last 7 days. Data aggregated from: MITRE Corporation ( CVE , CWE, CAPEC), National Vulnerability Database - NIST (NVD), CISA Known Exploited Vulnerabilities (KEV), FIRST (EPSS).

2026-05-23 21:08 UTC
KB5082417 - Details, Issues, & Feedback - NinjaOne

web:www.ninjaone.com

Overview KB5082417 is an April 14, 2026 cumulative security and reliability update for the .NET Framework 3.5 and 4.8.1 components on Windows 11 version 25H2 and Microsoft Server Operating System 24H2. This patch addresses multiple critical security vulnerabilities affecting the .NET Framework runtime environment, including remote code execution and denial-of-service attack vectors. The update ...

2026-05-23 21:08 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-23 21:08 UTC
Oracle Patches 450 Vulnerabilities With April 2026 CPU

web:www.securityweek.com

Oracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU). Across the 28 product families that received security updates, more than 300 patches address vulnerabilities that are remotely exploitable without authentication.

2026-05-23 21:08 UTC
Windows Kerberos RC4 deprecation: what will break in Active Directory ...

web:4sysops.com

Starting in April 2026 , Windows updates will change the default Kerberos ticket issuance behavior to AES-SHA1 for accounts without explicit encryption settings, while RC4 can still be used where explicitly enabled. This change, driven by CVE - 2026 -20833, affects every Windows Server environment where service accounts or devices still rely on RC4. Any service account, NAS device, or legacy ...

2026-05-26 02:48 UTC
Security Advisory Bulletin 064 | Ubiquiti Community

web:community.ui.com

Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...

2026-05-26 02:48 UTC
Microsoft Releases Out-of-Band Patch to Fix Critical RRAS RCE ...

web:cybersecuritynews.com

Microsoft released an out-of-band hotpatch update on March 13, 2026 , addressing serious security vulnerabilities in Windows 11 versions 24H2 and 25H2.

2026-05-26 02:48 UTC
NVD - Home

web:nvd.nist.gov

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

2026-05-26 02:48 UTC
Microsoft releases Windows 11 OOB hotpatch to fix RRAS RCE flaw

web:www.bleepingcomputer.com

Microsoft has released an out-of-band (OOB) update to fix a security vulnerabilities affecting Windows 11 Enterprise devices that receive hotpatch updates instead of the regular Patch Tuesday ...

2026-05-26 02:48 UTC
Microsoft Issues Massive Windows Patch for 160+ Bugs ... - TechRepublic

web:www.techrepublic.com

Microsoft's April 2026 Patch Tuesday fixes 165 vulnerabilities, including two zero-days, in one of the company's largest monthly security updates.

2026-05-26 02:48 UTC
Install Microsoft's emergency Windows patch now - ZDNET

web:www.zdnet.com

Install Microsoft's emergency Windows patch now - what it fixes and why it was rushed out Microsoft issued an out-of-band fix after its latest update introduced a nasty surprise.

2026-05-26 02:48 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-42217.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42217",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-07T12:07:53.292713Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-07T12:08:50.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openexr",
          "vendor": "AcademySoftwareFoundation",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.0.0, < 3.2.9"
            },
            {
              "status": "affected",
              "version": ">= 3.3.0, < 3.3.11"
            },
            {
              "status": "affected",
              "version": ">= 3.4.0, < 3.4.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger() decodes a variable-length integer from untrusted EXR input without bounding the shift count. After enough continuation bytes, the code executes a left shift by 70 on a 64-bit value, which is undefined behavior. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T04:04:54.736Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m"
        },
        {
          "name": "https://github.com/AcademySoftwareFoundation/openexr/pull/2378",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/2378"
        },
        {
          "name": "https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c"
        }
      ],
      "source": {
        "advisory": "GHSA-3c67-4wwp-w52m",
        "discovery": "UNKNOWN"
      },
      "title": "OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42217",
    "datePublished": "2026-05-07T04:04:54.736Z",
    "dateReserved": "2026-04-25T05:04:37.028Z",
    "dateUpdated": "2026-05-07T12:08:50.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}