CVE-2026-40250 | AcademySoftwareFoundation OpenEXR up to 3.2.7/3.3.9/3.4.9 EXR File internal_dwa_compressor.h integer overflow (GHSA-m5qw-23×2-6phj)

A vulnerability described as critical has been identified in AcademySoftwareFoundation OpenEXR up to 3.2.7/3.3.9/3.4.9. This issue affects some unknown processing of the file internal_dwa_compressor.h of the component EXR File Handler. Executing a manipulation can lead to integer overflow.

The identification of this vulnerability is CVE-2026-40250. The attack may be launched remotely. There is no exploit available.

Upgrading the affected component is recommended.