AcademySoftwareFoundation OpenEXR up to 3.4.12 HTJ2K Decode Path exr_start_read assertion

Summaryinfo

A vulnerability was found in AcademySoftwareFoundation OpenEXR up to 3.4.12 and classified as problematic. The impacted element is the function exr_start_read of the component HTJ2K Decode Path. Such manipulation leads to assertion. This vulnerability is traded as CVE-2026-54920. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in AcademySoftwareFoundation OpenEXR up to 3.4.12. It has been rated as problematic. Affected by this issue is the function exr_start_read of the component HTJ2K Decode Path. The manipulation with an unknown input leads to a assertion vulnerability. Using CWE to declare the problem leads to CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. Impacted is availability. CVE summarizes:

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service. The crash is triggered by a QCD marker whose lower five bits are zero, which OpenEXR passes into the vendored OpenJPH library while constructing the codestream and evaluating its quantization delta parameters. OpenJPH uses an assertion rather than a recoverable error to validate those bits, so any invalid value calls abort() directly and cannot be intercepted by surrounding error handling, a problem compounded by OpenEXR wrapping only its internal HT header parser in error handling while leaving the later codestream read and construction calls unprotected. This issue has been resolved in version 3.4.13.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-54920 since 06/16/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 3.4.13 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenEXR

Version

• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9
• 3.4.10
• 3.4.11
• 3.4.12

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/openexr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion