CVE-2026-26981

Affected versions of the OpenEXR package are vulnerable to a Heap Buffer Overflow due to a signed-to-unsigned integer conversion error in the memory-mapped stream reading path. The istream_nonparallel_read function in ImfContextInit.cpp computes a clamped read size by subtracting the projected end offset from the stream size, but when the projected end exceeds the stream size, the result is a negative int64_t value that is implicitly converted to a massive size_t value and passed to memcpy. An attacker who supplies a crafted EXR file can trigger an out-of-bounds heap read, resulting in a crash and Denial of Service.