Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service. The crash is triggered by a QCD marker whose lower five bits are zero, which OpenEXR passes into the vendored OpenJPH library while constructing the codestream and evaluating its quantization delta parameters. OpenJPH uses an assertion rather than a recoverable error to validate those bits, so any invalid value calls abort() directly and cannot be intercepted by surrounding error handling, a problem compounded by OpenEXR wrapping only its internal HT header parser in error handling while leaving the later codestream read and construction calls unprotected. This issue has been resolved in version 3.4.13.
Published: 2026-08-24
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via unconditional process abort
Action: Patch
AI Analysis

Impact

A crafted HTJ2K‑compressed EXR file triggers an assertion in the vendored OpenJPH library used by OpenEXR. The assertion, instead of returning an error, calls abort() immediately, causing the application that invokes exr_start_read() to terminate. This unhandled abort is the root of a denial‑of‑service weakness (CWE‑617).

Affected Systems

The issue affects the Academy Software Foundation OpenEXR library, versions 3.4.0 through 3.4.12. Any application that links to these library releases and reads untrusted EXR files will be vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, indicating a medium‑to‑high severity. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves an application processing an untrusted or maliciously crafted EXR file, such as a user upload or a file received over a network. If the application uses exr_start_read() on such input, the crash will occur without any opportunity for surrounding error handling to intervene.

Generated by OpenCVE AI on August 24, 2026 at 23:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the OpenEXR library to version 3.4.13 or later and rebuild any dependent applications to use the updated library.
  • If an immediate upgrade is not possible, limit the processing of HTJ2K‑compressed EXR files to a trusted, isolated environment or block untrusted file sources from reaching the application.
  • Implement input validation that rejects or sanitizes EXR files where the QCD marker lower five bits are zero before passing the data to OpenEXR’s exr_start_read() function.

Generated by OpenCVE AI on August 24, 2026 at 23:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 24 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Description OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service. The crash is triggered by a QCD marker whose lower five bits are zero, which OpenEXR passes into the vendored OpenJPH library while constructing the codestream and evaluating its quantization delta parameters. OpenJPH uses an assertion rather than a recoverable error to validate those bits, so any invalid value calls abort() directly and cannot be intercepted by surrounding error handling, a problem compounded by OpenEXR wrapping only its internal HT header parser in error handling while leaving the later codestream read and construction calls unprotected. This issue has been resolved in version 3.4.13.
Title OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)
Weaknesses CWE-617
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-28T17:52:11.296Z

Reserved: 2026-06-09T17:30:33.457Z

Link: CVE-2026-53532

cve-icon Vulnrichment

Updated: 2026-08-28T17:51:43.391Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T23:16:36.920

Modified: 2026-09-09T21:07:31.353

Link: CVE-2026-53532

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-24T22:24:02Z

Links: CVE-2026-53532 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T23:45:17Z

Weaknesses