What’s Vulnerable › Vulnerabilities

CVE-2026-65979: OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)

• Severity: medium (CVSS 6.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-25 · updated 2026-09-09
• Weakness: CWE-20

Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field (PLEN) from a chunk's compressed data but never checks that this value fits within the available buffer before using it. When decoding, it advances the codestream pointer by the attacker-supplied header size and passes the resulting offset and remaining length to the OpenJPH memory-input path, so a crafted value pushes the pointer past the end of the buffer and causes an out-of-bounds read. Because this field comes straight from attacker-controlled EXR chunk data, the flaw is reachable during normal decoding of an untrusted file. This issue is fixed in version 3.4.13.

Affected products

• AcademySoftwareFoundation openexr: from 3.4.0, < 3.4.13

References

• https://github.com/AcademySoftwareFoundation/openexr/commit/c7af2d233b7b2a4452c11f26cf47584cc2b35721
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.13
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3j9c-j7c9-x293
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3j9c-j7c9-x293

Get alerted when CVE-2026-65979 or the next vulnerability affects your stack