CVE-2026-45696

Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, the HTJ2K (High-Throughput JPEG 2000) decoder, ht_undo_impl() in OpenEXRCore is vulnerable to a heap-buffer-overflow READ. The ht_undo_imp function copies decoded pixels out of a per-line OpenJPH buffer using the EXR channel's declared width as the iteration count. The codestream embedded in the EXR chunk can declare different (smaller) tile/line dimensions than the EXR header advertises, but ht_undo_impl() does not validate this — it pulls width 32-bit samples from cur_line->i32[] without checking the OpenJPH line buffer's actual length. A crafted EXR file produces a 4-byte heap-buffer-overflow READ immediately after a buffer allocated by ojph::local::codestream::finalize_alloc(). The bug is reachable through the standard scanline-decode entry point used by every consumer of exr_decoding_run/Imf::checkOpenEXRFile, including thumbnailers, asset pipelines, and the exrcheck utility — i.e. any application that opens untrusted EXR files. The result is a deterministic crash (DoS) and potential adjacent-heap leak. This issue has been fixed in version 3.4.12.

Weakness classification

• security-advisories@github.com: CWE-122
• 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-125

Primary references

• security-advisories@github.com — Release Notes
• security-advisories@github.com — Exploit, Vendor Advisory
• 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
• 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Vendor Advisory
• 0b0ca135-0b70-47e7-9f44-1890c2a1c46c