AcademySoftwareFoundation OpenEXR up to 3.4.12 HTJ2K decoder input validation

Summaryinfo

A vulnerability labeled as critical has been found in AcademySoftwareFoundation OpenEXR up to 3.4.12. This affects an unknown function of the component HTJ2K decoder. Such manipulation leads to input validation. This vulnerability is documented as CVE-2026-65979. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in AcademySoftwareFoundation OpenEXR up to 3.4.12. It has been rated as critical. Affected by this issue is an unknown part of the component HTJ2K decoder. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field (PLEN) from a chunk's compressed data but never checks that this value fits within the available buffer before using it. When decoding, it advances the codestream pointer by the attacker-supplied header size and passes the resulting offset and remaining length to the OpenJPH memory-input path, so a crafted value pushes the pointer past the end of the buffer and causes an out-of-bounds read. Because this field comes straight from attacker-controlled EXR chunk data, the flaw is reachable during normal decoding of an untrusted file. This issue is fixed in version 3.4.13.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-65979 since 07/23/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 3.4.13 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• AcademySoftwareFoundation

Name

• OpenEXR

Version

• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9
• 3.4.10
• 3.4.11
• 3.4.12

License

• open-source

Website

• Product: https://github.com/AcademySoftwareFoundation/openexr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion