AcademySoftwareFoundation OpenEXR up to 3.4.10 EXR Image internal_ht.cpp ht_undo_impl integer overflow

Summaryinfo

A vulnerability was found in AcademySoftwareFoundation OpenEXR up to 3.4.10. It has been classified as problematic. The affected element is the function ht_undo_impl in the library src/lib/OpenEXRCore/internal_ht.cpp of the component EXR Image Handler. Performing a manipulation results in integer overflow. This vulnerability is cataloged as CVE-2026-44663. The attack must be initiated from a local position. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in AcademySoftwareFoundation OpenEXR up to 3.4.10. This affects the function ht_undo_impl in the library src/lib/OpenEXRCore/internal_ht.cpp of the component EXR Image Handler. The manipulation with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on integrity, and availability. The summary by CVE is:

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, an integer overflow in ht_undo_impl() in src/lib/OpenEXRCore/internal_ht.cpp leads to a heap-buffer overflow when decoding a crafted HTJ2K-compressed EXR file. decode->channels[i].width (int32_t) is multiplied by bytes_per_element in 32-bit signed arithmetic. With large widths (e.g., >= 536870912 for FLOAT data), this overflows, producing a corrupted offset that is later used for pointer arithmetic and can cause a heap out-of-bounds write. The same unchecked multiplication pattern appears in two other HTJ2K paths (bytes-per-line accumulation and pixel-line pointer advancement). As with related CVE-2026-34378 through CVE-2026-34589 fixes in other codecs, validating only after the multiplication is too late because the value may already be overflowed. This issue has been fixed in version 3.4.12.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-44663 since 05/07/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 321448 (Python Library OpenEXR 3.4.x < 3.4.12 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.4.11 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (321448). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenEXR

Version

• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9
• 3.4.10

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/openexr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion