ETK-2026-707Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-707",
  "cve_id": null,
  "display_id": "ETK-2026-707",
  "ghsa_id": "GHSA-m88g-pjc7-xfhv",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Signed integer overflow in OpenEXR scanline decoding",
  "summary": "OpenEXR versions through 3.1.5 mishandle scanline sizing while decoding certain EXR files. An attacker who can supply an EXR image to an application can cause the decoding process to be terminated through excessive memory allocation. Exposure requires processing untrusted EXR input, directly or through software that uses OpenEXR.",
  "mitigation": "Upgrade OpenEXR to version 3.1.6 or later. Until upgraded, do not process untrusted EXR files and isolate image-decoding workloads with resource limits.",
  "vendor": "c/c++",
  "product": "c/c++:OpenEXR",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "3.1.0-3.1.5"
      ],
      "ecosystem": "c/c++",
      "fixed_versions": [
        "3.1.6"
      ],
      "package_name": "OpenEXR",
      "purl": null
    }
  ],
  "cwes": [
    190
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.690464933333333,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-05T16:01:01+00:00",
      "days": -15.766613938425927,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T10:24:56.479661+00:00",
      "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m88g-pjc7-xfhv"
    }
  }
}